Packages changed:
  AppStream (1.2.1 -> 1.2.2)
  MicroOS-release (20261107 -> 20261108)
  compat-usrmerge
  ddcutil (2.2.7 -> 3.0.2)
  gcc16 (16.2.1+git9713 -> 16.2.1+git9901)
  libsndfile
  lvm2 (2.03.43 -> 2.03.44)
  lvm2-device-mapper (2.03.43_1.02.217 -> 2.03.44_1.02.218)
  openssh (10.6p1 -> 10.6p2)
  python-pyasn1 (0.6.4 -> 0.6.5)
  sqlite3

=== Details ===

==== AppStream ====
Version update (1.2.1 -> 1.2.2)
Subpackages: libAppStreamQt3 libappstream5

- Add upstream change:
  * 0001-bundle-Add-back-support-for-Limba.patch
- Update to version 1.2.2:
  * Features:
    + Content-rating: Add attribute titles and group descriptions
    + Pool: Allow adding extra data locations with explicit scope and origin
    + Ascli: sysinfo: Print some more information about the OS, like its
    support period
    + Bundle: Drop Limba, add Manifold
  * Bugfixes:
    + Cli: Fail YAML validation for missing input
    + Compose: Fix build on a newer kernel with an old glibc
    + Pool: Work around all Flatpak origins having the same name
    + Pool: Include scope in metadata cache keys for Flatpak
    + Apt: Don't hang when tar emits lots of stderr output
    + Its: Support MetaInfo files that use the specification's namespace
    + System-info: Don't prefix an OS ID that already is rDNS
    + Sysinfo: Also replace `-` with `_` at `dns_to_rdns` function
- Update version dependencies according to meson.build.

==== MicroOS-release ====
Version update (20261107 -> 20261108)
Subpackages: MicroOS-release-appliance MicroOS-release-dvd

- automatically generated by openSUSE-release-tools/pkglistgen

==== compat-usrmerge ====

- Install usrmerge.attr non-executable, it is a fileattr definition
  and not a script
- Fix typo in the main package description
- Build the build subpackage as noarch, its fileattr script and
  bin/sbin dependency data are architecture-independent
- Replace unbounded strcpy/stpcpy calls in usrmergecheck with
  snprintf
- Run spec-cleaner in full mode

==== ddcutil ====
Version update (2.2.7 -> 3.0.2)

- Fix i586 %check failure in test_string_util: fail str_to_long()
  on strtol ERANGE overflow instead of clamping to LONG_MAX/MIN,
  which made str_to_int() wrongly succeed for out-of-range input
  on ILP32 (ddcutil-strtol-erange.patch).
- Update to version 3.0.2 (3.0.0 and 3.0.1 had severe
  reliability and performance issues, skip them):
  * Reworked display connect/disconnect handling for
    performance and reliability; Plasma users should update
  * 3.0.1: reverted to serial i2c examination (parallel checks
    crashed AMD Navi / Plasma wouldn't start)
  * 3.0.2: dropped the single multi-message EDID ioctl (severe
    slowdowns without EDID, possible amdgpu crash); built-in
    Valve Index HMD ignore list
  * The i2c GROUP udev rule now ships commented out per
    upstream packaging-policy note (boo#1277442)
  * No SONAME change (libddcutil.so.5)
  * Align BuildRequires floors with configure.ac: glib-2.0 >= 2.40,
    jansson >= 2.0, libdrm >= 2.4.67, libusb-1.0 >= 1.0.15
- Drop Group: tags

==== gcc16 ====
Version update (16.2.1+git9713 -> 16.2.1+git9901)
Subpackages: cpp16 libgcc_s1 libgomp1 libstdc++6

- Update to gcc-16 branch head, git9901
  * pulls fix for stack corruption in std::bitset stream extraction
    [bsc#1289549] [gcc#124370] (CVE-2026-115455)
  * pulls fix for std::from_chars to not read past end of input
    [bsc#1289550] [gcc#127666] (CVE-2026-115456)
  * pulls fix for buffer overrun in __gnu_parallel search
    [bsc#1288775] (CVE-2026-114690)
  * pulls fix for overflow in std::vector<bool> constructors
    [bsc#1288774] (CVE-2026-114691)

==== libsndfile ====

- Fix information disclosure via uninitialized variable use in WAV
  parsing (CVE-2026-109828, bsc#1285421):
  libsndfile-CVE-2026-109828.patch

==== lvm2 ====
Version update (2.03.43 -> 2.03.44)
Subpackages: liblvm2cmd2_03

- lvm2.changes
  * Amend entries from me@jacobbaungard.com and tomas.chvatal@gmail.com
- lvm2.spec
  * reorder patches
- Update patches for btrfs fsadm support due to commit 2575c7d9079e:
  * fate-31841-03_tests-new-test-suite-of-fsadm-for-btrfs.patch
  * fate-31841-03_tests-new-test-suite-of-fsadm-for-btrfs.patch
- Update to version 2.03.44
  * Round non-power-of-two VDO slab size up to a power of two in lvcreate.
  * Make pthread_setname_np optional for older pthread libraries.
  * Fix blkio invalidation of held or dirty blocks and interrupted waits.
  * Report synchronous I/O failures through the blkio completion path.
  * Release the label scan before forking the polldaemon.
  * Add configure --with/out-libaio to control async engine support.
  * Add configure --with/out-liburing to control io_uring support.
  * Add optional io_uring io engine (requires liburing, kernel 5.1+).
  * Default the I/O engine to iouring, then threads, then libaio, then sync.
  * Add pthread-based I/O engine to eliminate libaio io_destroy penalty.
  * Deprecate use_aio; use_aio=0 still selects sync I/O.
  * Add io_engine config to select the I/O engine.
  * Warn and use sync I/O when the requested I/O engine is unavailable.
  * Zero fill the tail of a short io engine read at the end of a device.
  * Drain in-flight libaio on io engine destroy.
  * Remove orphaned pvmove LV when force-removing a RAID LV locked for pvmove.
  * Preserve committed metadata when pv_write updates an existing PV.
  * Use mdadm-compatible CRC-32 when detecting DDF metadata.
  * Detect NVMe multipath devices and handle uncached primary devices.
  * Use the VDO pool data LV size for VDO memory checks.
  * Warn about RAID reshape data corruption on kernels older than 6.11.
  * Suggest remedies when duplicate PV devices block VG updates or activation.
  * Improve documentation about PVs layered on top of LVs.
  * Reject cache pool resize with a clear error instead of failing internally.
  * Preserve RAID1 recovery state and rebuild markers when reducing images.
  * Accept transient or incomplete dm-raid status during repair and reduction.
  * Report the dead-primary RAID repair advice instead of refusing a rebuild.
  * Fix out-of-bounds read when parsing short dmeventd client messages.
  * Reject malformed numeric fields in dmeventd client registration messages.
  * Reject dmeventd registrations without a plugin or device name.
  * Use non-blocking dmeventd FIFO I/O and timeouts for stalled clients.
  * Fix dmeventd timeout thread spin when no timeout is scheduled.
  * Fix dmeventd monitor thread list when a thread fails before linking.
  * Unregister dmeventd devices from plugins if monitoring stops early.
  * Do not reuse dmeventd grace-period threads when the device inode is unknown.
  * Reset dmeventd pending SIGALRM without changing signal disposition.
  * Warn when parent directories of dmeventd FIFO paths are not secure.
  * Validate systemd-activated dmeventd FIFOs and use non-blocking I/O.
  * Fix dmeventd info when the running daemon returns no status reply data.
  * Run build-tree binaries against build libraries, not installed copies.
  * Avoid spurious dmeventd unregister errors when removing monitored snapshots.
  * Run mirror repair from dmeventd when mirror reports in-sync with failed legs.
  * Fix out-of-bounds access on an unterminated mda_header raw_locns (BZ2510937).
  * Log open failures at debug for devices excluded after scan I/O errors.
  * Fix blkdeactivate to exit 0 when devices stay mounted by policy.
  * Fix blkdeactivate -l wholevg when another LV in the VG stays mounted.
  * Fix blkdeactivate exit status on failed deactivation or mpath queueing.
  * Fix blkdeactivate umount for paths with spaces or lsblk hex escapes.
  * Update lvmdump for lvmlockd; add -A; drop lvmetad collection.
  * Harden fsadm size parsing and use mktemp for temporary mount dirs.
  * Ignore _FSADM_YES from the environment; pass --yes only from the CLI.
  * Fix fsadm fsck exit codes and mount detection via /proc/self/mountinfo.
  * Harden lvm_import_vdo YAML and stat parsing against shell injection.
  * Use mktemp in lvm_import_vdo; validate TMPDIR and tool binary overrides.
  * Harden lvresize_fs_helper temp mounts, signal cleanup, and TMPDIR checks.
  * Validate lvresize_fs_helper resize sizes and value-taking options.
  * Fix lvresize_fs_helper btrfs, e2fsck handling, and --fsextend/--fsreduce.
  * Prevent redundant device access after scan I/O errors (DEV_SCAN_NOT_READ).
  * Apply lvmlockd --lockopt force to all lock requests.
  * Keep PR state after failed start.
  * Apply PTPL when extending VG to ensure persistence when power cycling devs.
  * Allow vgextend before any host starts PR on new devs.
  * Fix pvscan autoactivation when DEVLINKS symlinks are not yet created.
- rebase fate-31841-01_fsadm-add-support-to-resize-check-btrfs-filesystem.patch
  to match with new version.
- remove bug-1288220_pvscan-preserve-preferred-device-name-when-importing.patch

==== lvm2-device-mapper ====
Version update (2.03.43_1.02.217 -> 2.03.44_1.02.218)
Subpackages: device-mapper libdevmapper-event1_03 libdevmapper1_03

- lvm2.changes
  * Amend entries from me@jacobbaungard.com and tomas.chvatal@gmail.com
- lvm2.spec
  * reorder patches
- Update patches for btrfs fsadm support due to commit 2575c7d9079e:
  * fate-31841-03_tests-new-test-suite-of-fsadm-for-btrfs.patch
  * fate-31841-03_tests-new-test-suite-of-fsadm-for-btrfs.patch
- Update to version 2.03.44
  * Round non-power-of-two VDO slab size up to a power of two in lvcreate.
  * Make pthread_setname_np optional for older pthread libraries.
  * Fix blkio invalidation of held or dirty blocks and interrupted waits.
  * Report synchronous I/O failures through the blkio completion path.
  * Release the label scan before forking the polldaemon.
  * Add configure --with/out-libaio to control async engine support.
  * Add configure --with/out-liburing to control io_uring support.
  * Add optional io_uring io engine (requires liburing, kernel 5.1+).
  * Default the I/O engine to iouring, then threads, then libaio, then sync.
  * Add pthread-based I/O engine to eliminate libaio io_destroy penalty.
  * Deprecate use_aio; use_aio=0 still selects sync I/O.
  * Add io_engine config to select the I/O engine.
  * Warn and use sync I/O when the requested I/O engine is unavailable.
  * Zero fill the tail of a short io engine read at the end of a device.
  * Drain in-flight libaio on io engine destroy.
  * Remove orphaned pvmove LV when force-removing a RAID LV locked for pvmove.
  * Preserve committed metadata when pv_write updates an existing PV.
  * Use mdadm-compatible CRC-32 when detecting DDF metadata.
  * Detect NVMe multipath devices and handle uncached primary devices.
  * Use the VDO pool data LV size for VDO memory checks.
  * Warn about RAID reshape data corruption on kernels older than 6.11.
  * Suggest remedies when duplicate PV devices block VG updates or activation.
  * Improve documentation about PVs layered on top of LVs.
  * Reject cache pool resize with a clear error instead of failing internally.
  * Preserve RAID1 recovery state and rebuild markers when reducing images.
  * Accept transient or incomplete dm-raid status during repair and reduction.
  * Report the dead-primary RAID repair advice instead of refusing a rebuild.
  * Fix out-of-bounds read when parsing short dmeventd client messages.
  * Reject malformed numeric fields in dmeventd client registration messages.
  * Reject dmeventd registrations without a plugin or device name.
  * Use non-blocking dmeventd FIFO I/O and timeouts for stalled clients.
  * Fix dmeventd timeout thread spin when no timeout is scheduled.
  * Fix dmeventd monitor thread list when a thread fails before linking.
  * Unregister dmeventd devices from plugins if monitoring stops early.
  * Do not reuse dmeventd grace-period threads when the device inode is unknown.
  * Reset dmeventd pending SIGALRM without changing signal disposition.
  * Warn when parent directories of dmeventd FIFO paths are not secure.
  * Validate systemd-activated dmeventd FIFOs and use non-blocking I/O.
  * Fix dmeventd info when the running daemon returns no status reply data.
  * Run build-tree binaries against build libraries, not installed copies.
  * Avoid spurious dmeventd unregister errors when removing monitored snapshots.
  * Run mirror repair from dmeventd when mirror reports in-sync with failed legs.
  * Fix out-of-bounds access on an unterminated mda_header raw_locns (BZ2510937).
  * Log open failures at debug for devices excluded after scan I/O errors.
  * Fix blkdeactivate to exit 0 when devices stay mounted by policy.
  * Fix blkdeactivate -l wholevg when another LV in the VG stays mounted.
  * Fix blkdeactivate exit status on failed deactivation or mpath queueing.
  * Fix blkdeactivate umount for paths with spaces or lsblk hex escapes.
  * Update lvmdump for lvmlockd; add -A; drop lvmetad collection.
  * Harden fsadm size parsing and use mktemp for temporary mount dirs.
  * Ignore _FSADM_YES from the environment; pass --yes only from the CLI.
  * Fix fsadm fsck exit codes and mount detection via /proc/self/mountinfo.
  * Harden lvm_import_vdo YAML and stat parsing against shell injection.
  * Use mktemp in lvm_import_vdo; validate TMPDIR and tool binary overrides.
  * Harden lvresize_fs_helper temp mounts, signal cleanup, and TMPDIR checks.
  * Validate lvresize_fs_helper resize sizes and value-taking options.
  * Fix lvresize_fs_helper btrfs, e2fsck handling, and --fsextend/--fsreduce.
  * Prevent redundant device access after scan I/O errors (DEV_SCAN_NOT_READ).
  * Apply lvmlockd --lockopt force to all lock requests.
  * Keep PR state after failed start.
  * Apply PTPL when extending VG to ensure persistence when power cycling devs.
  * Allow vgextend before any host starts PR on new devs.
  * Fix pvscan autoactivation when DEVLINKS symlinks are not yet created.
- rebase fate-31841-01_fsadm-add-support-to-resize-check-btrfs-filesystem.patch
  to match with new version.
- remove bug-1288220_pvscan-preserve-preferred-device-name-when-importing.patch

==== openssh ====
Version update (10.6p1 -> 10.6p2)
Subpackages: openssh-clients openssh-common openssh-server

- Update to openssh 10.6p2:
  This release contains a critical security workaround that affects
  Linux systems that use the musl libc and PAM disabled.
  This release also includes a number of bugfixes that had already
  been committed on the portable OpenSSH V_10_6 stable branch.
  = Future deprecation notice
  * scp(1): begin deprecating the -R flag, which is used to perform
    a remote-to-remote copy by executing scp on a remote host. This
    option is a fragile optimisation that is difficult to use
    because it requires credentials on the remote host. It also
    creates security risks if the shell quoting rules on the remote
    system where the copy is performed differ from the client's
    expectations.
    From OpenSSH 10.6, this option will continue to work but will
    cause a deprecation warning to be emitted to standard error. In
    a future release, the option will be ignored and will leave in
    place the default remote-to-remote copy behaviour (copy via the
    host running scp).
  * sshd(8): support for platforms that do not allow file
    descriptor passing and that also require root privilege for PTY
    allocation will be removed in a future release. Affected
    platforms are known to include SCO OpenServer 5 and QNX 6 but
    may include other similarly old operating systems. This
    deprecation can be avoided if the user community for these
    platforms is able to assist us in building alternatives, such
    as avoiding the need for root in PTY allocation.
  = Security
  * sshd(8): avoid password authentication bypass that is
    exploitable through sshd(8) that affects some Linux systems
    when built and run with PAM support disabled. We consider the
    root cause of this bug to be outside sshd, but it is
    exploitable via sshd and can be avoided there.
    This bug was reported by Özgün Kültekin of Wakefield
    (wakefield.co)
  = Bugfixes
  * sshd(8), ssh(1): enable the post-quantum hybris signature
    scheme ssh-mldsa44-ed25519 as an allowed CA signature
    algorithm.
  * ssh(1), sshd(8): fix <1 second CPU spin if ChannelTimeout was
    in use.
  = Portability
  * sshd(8): fix compilation on (old) platforms that set
    SKIP_PRIVDROP
  * ssh(1), sshd(8): fix detection of Azerbaijani locales
  * sshd(8), ssh-agent(1): fix creation of agent sockets on
    platforms without the openat(2) syscall.
  * ssh(1), ssh-add(1), ssh-keygen(1): fix some strange behaviour
    if SIGINT/SIGQUIT was received while reading a passphrase.
  * sshd(8): allow restart_syscall(2) in seccomp sandbox; bz4036

==== python-pyasn1 ====
Version update (0.6.4 -> 0.6.5)

- Update to 0.6.5 (bsc#1288851, CVE-2026-119194)
  * GHSA-mm57-4v3p-rchx: Decoded binary REAL mantissas in linear time
  instead of repeatedly shifting a growing integer and slicing the
  remaining bytes (thanks for reporting, manus-use, manus-pi, ucsurf,
  adriank31)
  * GHSA-2qm8-x737-gmw5: Reassembled constructed BIT STRING fragments
    in linear time while preserving their decoded bit values, including
    intermediate fragment padding (thanks for reporting, manus-use)
  * GHSA-9m75-vc3g-4x39: Reassembled constructed OCTET STRING and
    character-string fragments and indefinite-length ANY content in
    linear time. Nested constructed OCTET STRING fragments now contribute
    their decoded octets (thanks for reporting, alimony, manus-pi, adriank31)
  * GHSA-fm9c-5rcf-2q5p: Bounded schemaless container type tracking
    after two distinct tag sets to prevent quadratic CPU use from
    colliding long tag IDs (thanks for reporting, droideck)

==== sqlite3 ====

- Add sqlite-3.54.1-fix-waliter-test-64k-pages.patch to fix a test
  failure in %check on systems with 64KB pages (ppc64le, aarch64).
- Add sqlite-3.54.1-fix-fts3corrupt4-test-big-endian.patch to fix a
  test failure in %check on big-endian platforms (s390x). Upstream
  check-in 1a888ea60be20a80 made the test's big-endian special case
  obsolete.
- Add sqlite-3.54.1-fix-shell-import-line-count.patch to fix a test
  failure in %check on 32-bit big-endian platforms (s390): the line
  count shown by ".import" was printed from a 64-bit value with %d.