Packages changed:
  GraphicsMagick
  c-ares (1.34.8 -> 1.34.9)
  hwdata (0.412 -> 0.413)
  kwin6
  libstorage-ng (4.5.368 -> 4.5.369)
  live555 (2026.10.29 -> 2026.11.08)
  ncurses (6.6.20261017 -> 6.6.20261107)
  patterns-kde
  perl-Error (0.170.300 -> 0.170.310)
  poppler (26.10.0 -> 26.11.0)
  poppler-qt6 (26.10.0 -> 26.11.0)
  python-cffi (2.0.0 -> 2.1.1)
  python-click (8.5.0 -> 8.5.1)
  python-cssselect (1.5.0 -> 1.6.0)
  qatlib (26.02.0 -> 26.08.0)
  salt
  vsftpd
  yast2-samba-server
  yast2-trans (84.87.20261027.d68bd6c358 -> 84.87.20261109.9d96e853fa)

=== Details ===

==== GraphicsMagick ====
Subpackages: libGraphicsMagick++-Q16-12 libGraphicsMagick-Q16-3 libGraphicsMagick3-config

- added patches
  CVE-2026-116149: Memory corruption via crafted bzip2 compressed images [bsc#1288783]
  * GraphicsMagick-CVE-2026-116149.patch

==== c-ares ====
Version update (1.34.8 -> 1.34.9)

- c-ares 1.34.9:
  * buffer overflow when ares_dup() or ares_save_options() runs while another thread changes the servers (bsc#1289583)
  * uninitialized memory returned for a numeric IPv6 name with a prefix length (bsc#1289584)
  * the query cache could return an answer obtained using different EDNS options (bsc#1289585)
  * use-after-free when an application cancels lookups from a callback, or shuts a channel down (bsc#1289578)
  * use-after-free of a connection after the socket-state callback returns (bsc#1289579)
  * use-after-free when an application cancels lookups from a server-state callback (bsc#1289580)
  * use-after-free of a server record when an application changes its DNS servers from a callback (bsc#1289581)
  * use-after-free of a cached DNS answer while the application is still reading it (bsc#1289582)
  * memory corruption when an application cancels its lookups after a connection failure (bsc#1289574)
  * a DNS reply that arrived from a different server than the one queried could be accepted (bsc#1289575)
  * use-after-free of a lookup after shutting down a failed connection (bsc#1289576)
- test-fixes.patch: fix testsuite to only use localhost

==== hwdata ====
Version update (0.412 -> 0.413)

- Update to 0.413:
  * pci.ids refreshed to the 2026.10.31 snapshot (203 lines added,
    34 removed); oui.txt and pnp.ids refreshed

==== kwin6 ====
Subpackages: kwin6-lang libkwin6

- Add xwayland build dependency

==== libstorage-ng ====
Version update (4.5.368 -> 4.5.369)
Subpackages: libstorage-ng-lang libstorage-ng-ruby libstorage-ng1

- merge gh#openSUSE/libstorage-ng#1103
- add partition ids for /var and /var/tmp
- add tests for the new partition ids
- add integration test for the new partition ids
- Version bump
- Add some missing DPS GUIDs
- 4.5.369

==== live555 ====
Version update (2026.10.29 -> 2026.11.08)
Subpackages: libBasicUsageEnvironment2 libUsageEnvironment3 libgroupsock33 libliveMedia122

- Update to version 2026.11.08:
  * In "MultiFramedRTPSource" (for handling RTP reception), handle the case
    where a malformed RTP special header could cause no data to get delivered,
    and get us into an infinite loop. We now reject (the rest of) the packet in
    this case.
- Changes from version 2026.11.05:
  * Updated the 'authentication' fix that we made in version 2026.09.23: We no
    longer "reset()" the "Authenticator" if we get a "303" (REDIRECT) response,
    because the new server might still want to do Digest authentication (with
    the same username+password as the original server).
    Instead, once we receive a request for Digest authentication, we no longer
    allow Basic authentication (for this "RTSPClient") - either for the same
    server, or for any server that we get redirected to.

==== ncurses ====
Version update (6.6.20261017 -> 6.6.20261107)
Subpackages: libncurses6 ncurses-utils terminfo terminfo-base terminfo-iterm terminfo-screen

- Add ncurses patch 20261107
  + check for terminating NUL in canonical_name() for infocmp -F
    (report/testcase by Martin Mirchev).
  + fix an infinite loop in parse_ti_delay() on malformed terminfo
    (report/testcase by Martin Mirchev).
  + add valid_div() check to tparm '/' and '%' operators to guard against
    SIGFPE on dividing INT_MIN by -1 (report/testcase by Martin Mirchev).
  + add sanity-checks to _nc_infotocap() when moving mandatory padding
    (report/testcase by Martin Mirchev).
  + reorder check for missing '\0' in str_table and a strlen() call
    (report/testcase by Martin Mirchev).
  + add check in decode_xterm_X10() to ensure that enough bytes were
    read (report by Martin Mirchev).
  + use CLOCK_MONOTONIC instead of CLOCK_REALTIME when it is available
    (patch by Yeatol).
  + add limit check in lib_add_wch.c (report/testcase by Serhiy
    Storchaka),
  + improve cleanup on EOF in next_char (report by Oliver Zhang).
  + improve fix for filling cells for multicolumn characters in
    lib_addch.c (patch by Vassili Courzakis).
  + fixes for tvi910, tvi950, wy100 (patch by Adam Di Carlo)
- Add ncurses patch 20261031
  + improve configure check for wcwidth, for msys2 port.
  + modify configure check for multiuser systems to use getent if it is
    available.
  + remove obsolete configure macro CF_LDFLAGS_STATIC (prompted by
    discussion with Julian Waters).
  + modify convert_strings to disallow overlapping strings.
  + add null-pointer checks for terminfo/termcap function parameters.
  + pad str_table with a '\0' in case of malformed terminfo data which
    omits a '\0' on the final string (report/testcase by Can Ozkan).
- Add ncurses patch 20261024
  + modify initialization for term-driver return terminfo data when given
    a name in $TERM unless _nc_console_vt_supported() returns true, as in
    the missing-name branch (patch by Daniel Aliev).
  + correct initialization of fallback entries which using term-driver
    configuration (patch by Daniel Aliev).
  + correct limit check in lib_ins_wch.c (patch by Serhiy Storchaka,
    cf: 20260815)
  + initialize sp->_wacs_map for each screen, rather than reusing data,
    to help with delscreen (patch by Serhiy Storchaka, cf: 20260523).
  + improve ripoff window cleanup in delwin (report by Serhiy Storchaka).
  + fix a duplicate declaration of _nc_gettimeofday() (report by Abril
    Rincon Blanco).
  + improve check for end of file in next_char() (report by Lingfeng
    Chen).

==== patterns-kde ====
Subpackages: patterns-kde-kde patterns-kde-kde_edutainment patterns-kde-kde_games patterns-kde-kde_ide patterns-kde-kde_imaging patterns-kde-kde_internet patterns-kde-kde_multimedia patterns-kde-kde_office patterns-kde-kde_pim patterns-kde-kde_plasma patterns-kde-kde_utilities patterns-kde-kde_utilities_opt patterns-kde-kde_yast

- Have the main pattern recommend opensuse-welcome. This used to be pulled in
  by the various X-related patterns (IIRC last via games), which was cleaned
  up. As we have no underlying pattern for graphical systems anymore, desktops
  need to pull it in directly.

==== perl-Error ====
Version update (0.170.300 -> 0.170.310)

- updated to 0.170.310 (0.17031)
  see /usr/share/doc/packages/perl-Error/Changes
  0.17031         2026-10-27
  - t/08warndie.t - update to handle blead's updated line number tracking by richardleach
  - https://github.com/shlomif/perl-error.pm/pull/6
  - Thanks @richardleach .

==== poppler ====
Version update (26.10.0 -> 26.11.0)
Subpackages: libpoppler-cpp3 libpoppler-glib8 poppler-tools

- Update to version 26.11.0:
  * Core:
    + Fix subsetting annotations with multiline content
    + NSS: Fix crash if creating the hash context fails
    + Fix crash when saving documents with special forms
    + Properly apply password length limit
    + Annot: Fix the text width of widgets rotated 180 degrees
    + FlateStream::rewind: Don't consider the empty stream failing when
    reviwnding it
    + TextStringToUtf8: Fix PDFDocEncoding conversion
    + Internal code improvements
    + Fix crashes in malformed documents
  * Utils:
    + Increase max password length
    + Pdfsig: Allow to give multiple nss passwords
    + Pdfsig: Allow to input the password interactively
  * Qt6:
    + Expose the asset of RichMedia instances
    + Fix leak of RichMedia activation and deactivation
    + Check that Catalog::getForm() returns a Form before using it
  * Qt5:
    + Check that Catalog::getForm() returns a Form before using it
    + Fix leak of RichMedia activation and deactivation
- Update version dependencies according to meson.build.
- Bump soname following upstream changes.

==== poppler-qt6 ====
Version update (26.10.0 -> 26.11.0)

- Update to version 26.11.0:
  * Core:
    + Fix subsetting annotations with multiline content
    + NSS: Fix crash if creating the hash context fails
    + Fix crash when saving documents with special forms
    + Properly apply password length limit
    + Annot: Fix the text width of widgets rotated 180 degrees
    + FlateStream::rewind: Don't consider the empty stream failing when
    reviwnding it
    + TextStringToUtf8: Fix PDFDocEncoding conversion
    + Internal code improvements
    + Fix crashes in malformed documents
  * Utils:
    + Increase max password length
    + Pdfsig: Allow to give multiple nss passwords
    + Pdfsig: Allow to input the password interactively
  * Qt6:
    + Expose the asset of RichMedia instances
    + Fix leak of RichMedia activation and deactivation
    + Check that Catalog::getForm() returns a Form before using it
  * Qt5:
    + Check that Catalog::getForm() returns a Form before using it
    + Fix leak of RichMedia activation and deactivation
- Update version dependencies according to meson.build.
- Bump soname following upstream changes.

==== python-cffi ====
Version update (2.0.0 -> 2.1.1)

- update to 2.1.1:
  * Minimize internal Python API usage for interpreter and
    thread state sampling where possible.
  * Added the cffi-gen-src command-line tool
  * Added support for Python 3.15 and support for C extensions
    generated by CFFI to target the new abi3t free-threaded ABI. (#232)
  * Avoid crashes inside of __delitem__. (#235)
  * Avoid “string too big” error under MSVC. (#167)
  * Fix mingw builds. (#198)
- drop support-pycparser-3.patch (upstream)

==== python-click ====
Version update (8.5.0 -> 8.5.1)

- update to 8.5.1:
  * Fix `copy.deepcopy()` and `pickle` on a `Parameter`, `Option`
    or `Command`. {pr}`3805`
  * A `KeyboardInterrupt` arriving while `Command.main()` reports
    an abort or an error,
  * Add {meth}`Option.get_help_spec`, which returns the option's
    left help column even when the option is hidden.
  * The `Positional arguments` help section lists every argument
    of the command, not only the documented ones.
  * {meth}`Argument.get_help_record` always returns a tuple. It
    used to return `None` for an argument with no `help`.
  * Document which types are inferred from `default`, and what an
    unrecognized `type` callable does to a command-line value.
  * `path_type` narrows the converted value's type for `convert`
    and `prompt`.
  * A command's short help no longer stops at an abbreviation
    such as `vs.` or `e.g.` inside the first sentence. A period
    ends the sentence only when it closes the text or the next word
    does not start in lowercase.
  * With `show_envvar=True`, an option's error message now prints
    all variables of an `envvar` sequence instead of the `repr` of
    the sequence.
  * An empty `envvar`, such as `[]` or `""`, shows the same help
    and error message as no `envvar` when `show_envvar=True`. The
    help screen used to show `[env var: ]`.
  * Align command's deprecated help text to options and
    arguments: do not translate the command's own help text,
    only the `(DEPRECATED)` label.

==== python-cssselect ====
Version update (1.5.0 -> 1.6.0)

- update to 1.6.0:
  * Drop support for Python 3.10, add support for 3.15
  * Backward-incompatible: Relation (for :has()) now takes
    and exposes a list of (combinator, selector) pairs as
    arguments, replacing combinator and subselector
  * Backward-incompatible: the
    GenericTranslator.xpath_relation_*_combinator() methods
    now take only the XPath expression of the :has()
    argument and return an XPath condition string
  * :has() supports any relative selector list, e.g.
    :has(> a.important, + p b)
  * :not() supports complex selector arguments, e.g.
    :not(a.important[rel] > b)
  * Add i and s attribute selector flags, e.g.
    [href^="HTTP" i], for case-insensitive/sensitive matching
  * *|element and [*|attrib] match any namespace, including
    none; [|attrib] added for matching no namespace
  * Element.namespace and Attrib.namespace are "*" for the
    namespace wildcard
  * Align :enabled and :disabled with the HTML Living
    Standard:
  - input with no type or type="hidden" can now be
    :enabled and :disabled
  - links (a, area, link with href) are no longer
    :enabled
  - form controls inside the first legend of a disabled
    fieldset are no longer :disabled
  - option inside a disabled optgroup is now :disabled
  - command is no longer :enabled or :disabled, keygen
    is no longer :enabled
  * Replace null and surrogate code points (raw or escaped)
    with U+FFFD, as the CSS specification requires
  * Descendant combinator now translates to a descendant::
    step (e f -> e/descendant::f), faster in lxml
  * Class selectors and ~= now start with a plain
    contains() check, faster in lxml
  * Document non-standard ID selectors like #37signals

==== qatlib ====
Version update (26.02.0 -> 26.08.0)
Subpackages: libqat4 libusdm0

- version update to 26.08.0
  * Added support for QAT Gen6 devices. Supported key features: Dictionary compression, Z-Standard algorithm and KPT
  * Introduced the environment variable QAT_MAX_2M_HPG_PER_PROCESS to enable 2MB hugepages
  * Introduced EPOLL coalesce timer support across all QATlib-supported devices.
  * Added sla_mgr script for device management related to rate-limiting feature
  * Aligned with CPA API v5.09
  * Bug Fixes (See Resolved section in README.md)

==== salt ====
Subpackages: python313-salt salt-master salt-minion

- Fix asyncio_loop AttributeError in SyncWrapper on Python 3.6
- Support oscap options that select rules and content in xccdf_eval
- Added:
  * fix-asyncio_loop-attributeerror-in-syncwrapper-on-py.patch
  * support-the-oscap-options-that-select-rules-and-cont.patch

==== vsftpd ====

- Add vsftpd-CVE-2026-119567.patch: make cmds_allowed and cmds_denied
  apply to the RFC 775 aliases XMKD, XRMD, XPWD, XCWD and XCUP as
  well. Previously authenticated users could run denied commands by
  issuing their X-prefixed alias, e.g. XRMD instead of RMD.
  [CVE-2026-119567, bsc#1288995]
- Add vsftpd-no-stderr-on-control-connection.patch: session processes
  no longer have the client connection on stderr. Diagnostics printed
  by library code, such as "yp_bind_client_create_v3: RPC: Unable to
  send" from NIS lookups, were sent to FTP clients verbatim. They now
  go to the listener's stderr (the journal under systemd) or
  /dev/null instead. [bsc#1184651]
- vsftpd@.service: set StandardError=journal so that such messages are
  logged when vsftpd is socket-activated.
- Add vsftpd-CVE-2026-119568.patch: bind TLS sessions resumed on
  the data channel to the session of the corresponding control
  connection. Previously require_ssl_reuse accepted any resumed
  session ticket, allowing an attacker sharing the victim's source
  IP to hijack FTPS data connections. [CVE-2026-119568, bsc#1288996]

==== yast2-samba-server ====

- Supplement samba only when yast2 is already installed. If yast is not
  installed on the system, we do not want to pull it in (boo#1289484).

==== yast2-trans ====
Version update (84.87.20261027.d68bd6c358 -> 84.87.20261109.9d96e853fa)
Subpackages: yast2-trans-af yast2-trans-ar yast2-trans-bg yast2-trans-bn yast2-trans-bs yast2-trans-ca yast2-trans-cs yast2-trans-cy yast2-trans-da yast2-trans-de yast2-trans-el yast2-trans-en_GB yast2-trans-es yast2-trans-et yast2-trans-fa yast2-trans-fi yast2-trans-fr yast2-trans-gl yast2-trans-gu yast2-trans-hi yast2-trans-hr yast2-trans-hu yast2-trans-id yast2-trans-it yast2-trans-ja yast2-trans-jv yast2-trans-ka yast2-trans-km yast2-trans-ko yast2-trans-lo yast2-trans-lt yast2-trans-mk yast2-trans-mr yast2-trans-nb yast2-trans-nl yast2-trans-pa yast2-trans-pl yast2-trans-pt yast2-trans-pt_BR yast2-trans-ro yast2-trans-ru yast2-trans-si yast2-trans-sk yast2-trans-sl yast2-trans-sr yast2-trans-sv yast2-trans-ta yast2-trans-th yast2-trans-tr yast2-trans-uk yast2-trans-vi yast2-trans-wa yast2-trans-xh yast2-trans-zh_CN yast2-trans-zh_TW yast2-trans-zu

- Update to version 84.87.20261109.9d96e853fa:
  * Translated using Weblate (Russian)
  * Translated using Weblate (Russian)
  * Translated using Weblate (Russian)
  * Translated using Weblate (Slovak)
  * Translated using Weblate (Slovak)
  * Translated using Weblate (Slovak)
  * Translated using Weblate (Slovak)
  * Translated using Weblate (Slovak)
  * Translated using Weblate (Slovak)
  * Translated using Weblate (Slovak)
  * Translated using Weblate (Slovak)
  * Translated using Weblate (Slovak)
  * Translated using Weblate (Slovak)
  * Translated using Weblate (Slovak)
  * Translated using Weblate (Dutch)
  * Translated using Weblate (Dutch)
  * Translated using Weblate (Dutch)
  * Translated using Weblate (Dutch)
  * Translated using Weblate (Dutch)
  * Translated using Weblate (Dutch)
  * Translated using Weblate (Dutch)
  * Translated using Weblate (Dutch)
  * Translated using Weblate (Catalan)
  * Translated using Weblate (Catalan)
  * Translated using Weblate (Catalan)
  * Translated using Weblate (Catalan)
  * Translated using Weblate (Catalan)
  * Translated using Weblate (Catalan)
  * Translated using Weblate (Catalan)
  * Translated using Weblate (Catalan)
  * Translated using Weblate (Catalan)
  * Translated using Weblate (Catalan)
  * Translated using Weblate (Catalan)
  * Translated using Weblate (Catalan)
  * Translated using Weblate (Catalan)
  * Translated using Weblate (Catalan)
  * Translated using Weblate (Catalan)
  * Translated using Weblate (Catalan)
  * Translated using Weblate (Catalan)
  * Translated using Weblate (Catalan)
  * Translated using Weblate (Catalan)
  * Translated using Weblate (Catalan)
  * Translated using Weblate (Catalan)
  * Translated using Weblate (Catalan)
  * Translated using Weblate (Catalan)
  * Translated using Weblate (Catalan)
  * Translated using Weblate (Catalan)
  * Translated using Weblate (German)
  * Translated using Weblate (German)
  * Translated using Weblate (Japanese)
  * Translated using Weblate (Japanese)
  * Translated using Weblate (Japanese)
  * Translated using Weblate (Japanese)
  * Translated using Weblate (Japanese)
  * Translated using Weblate (Japanese)
  * Translated using Weblate (Japanese)
  * Translated using Weblate (Japanese)
  * Translated using Weblate (Japanese)
  * Translated using Weblate (Japanese)
  * Translated using Weblate (Japanese)
  * Translated using Weblate (Japanese)
  * Translated using Weblate (Japanese)
  * Translated using Weblate (Japanese)
  * Translated using Weblate (Japanese)
  * Translated using Weblate (Japanese)
  * Translated using Weblate (Japanese)
  * Translated using Weblate (Japanese)
  * Translated using Weblate (Japanese)
  * Translated using Weblate (Japanese)
  * Translated using Weblate (Japanese)
  * Translated using Weblate (Japanese)
  * Translated using Weblate (Japanese)
  * Translated using Weblate (Japanese)
  * Translated using Weblate (Japanese)
  * Translated using Weblate (Japanese)
  * Translated using Weblate (Slovak)
  * Translated using Weblate (Slovak)
  * Translated using Weblate (Slovak)
  * Translated using Weblate (Slovak)
  * Translated using Weblate (Slovak)
  * Translated using Weblate (Slovak)
  * Translated using Weblate (Slovak)
  * Translated using Weblate (Slovak)
  * Translated using Weblate (Slovak)
  * Translated using Weblate (Slovak)
  * Update translation files
  * Update translation files
  * Update translation files
  * Update translation files
  * Update translation files
  * Update translation files
  * Update translation files
  * Update translation files
  * Update translation files
  * Update translation files
  * Update translation files
  * Update translation files
  * Update translation files
    ... changelog too long, skipping 60 lines ...
  * New POT for text domain 'add-on'.