Packages changed:
  c-ares (1.34.8 -> 1.34.9)
  hwdata (0.412 -> 0.413)
  kwin6
  libdnf-plugin-txnupd (0.3.0 -> 0.4.0)
  live555 (2026.10.29 -> 2026.11.08)
  ncurses (6.6.20261017 -> 6.6.20261107)
  patterns-kde
  poppler (26.10.0 -> 26.11.0)
  poppler-qt6 (26.10.0 -> 26.11.0)
  python-cffi (2.0.0 -> 2.1.1)
  python-oauthlib (4.0.0 -> 4.0.1)

=== Details ===

==== c-ares ====
Version update (1.34.8 -> 1.34.9)

- c-ares 1.34.9:
  * buffer overflow when ares_dup() or ares_save_options() runs while another thread changes the servers (bsc#1289583)
  * uninitialized memory returned for a numeric IPv6 name with a prefix length (bsc#1289584)
  * the query cache could return an answer obtained using different EDNS options (bsc#1289585)
  * use-after-free when an application cancels lookups from a callback, or shuts a channel down (bsc#1289578)
  * use-after-free of a connection after the socket-state callback returns (bsc#1289579)
  * use-after-free when an application cancels lookups from a server-state callback (bsc#1289580)
  * use-after-free of a server record when an application changes its DNS servers from a callback (bsc#1289581)
  * use-after-free of a cached DNS answer while the application is still reading it (bsc#1289582)
  * memory corruption when an application cancels its lookups after a connection failure (bsc#1289574)
  * a DNS reply that arrived from a different server than the one queried could be accepted (bsc#1289575)
  * use-after-free of a lookup after shutting down a failed connection (bsc#1289576)
- test-fixes.patch: fix testsuite to only use localhost

==== hwdata ====
Version update (0.412 -> 0.413)

- Update to 0.413:
  * pci.ids refreshed to the 2026.10.31 snapshot (203 lines added,
    34 removed); oui.txt and pnp.ids refreshed

==== kwin6 ====
Subpackages: libkwin6

- Add xwayland build dependency

==== libdnf-plugin-txnupd ====
Version update (0.3.0 -> 0.4.0)

- Update to 0.4.0:
  * Fix linking with libtukit
  * Finalize snapshots after libdnf5 closes rpmdb
  * Log finish() messages in logger
  * Report snapshot create failures, instead of aborting
  * apply-live: Sync /etc state before applying snapshot
  * Drop version information from manpage
- Drop 3add4c39b5506f8bfafd1daca3bf6165e55c5e18.patch

==== live555 ====
Version update (2026.10.29 -> 2026.11.08)
Subpackages: libBasicUsageEnvironment2 libUsageEnvironment3 libgroupsock33 libliveMedia122

- Update to version 2026.11.08:
  * In "MultiFramedRTPSource" (for handling RTP reception), handle the case
    where a malformed RTP special header could cause no data to get delivered,
    and get us into an infinite loop. We now reject (the rest of) the packet in
    this case.
- Changes from version 2026.11.05:
  * Updated the 'authentication' fix that we made in version 2026.09.23: We no
    longer "reset()" the "Authenticator" if we get a "303" (REDIRECT) response,
    because the new server might still want to do Digest authentication (with
    the same username+password as the original server).
    Instead, once we receive a request for Digest authentication, we no longer
    allow Basic authentication (for this "RTSPClient") - either for the same
    server, or for any server that we get redirected to.

==== ncurses ====
Version update (6.6.20261017 -> 6.6.20261107)
Subpackages: libncurses6 ncurses-utils terminfo-base

- Add ncurses patch 20261107
  + check for terminating NUL in canonical_name() for infocmp -F
    (report/testcase by Martin Mirchev).
  + fix an infinite loop in parse_ti_delay() on malformed terminfo
    (report/testcase by Martin Mirchev).
  + add valid_div() check to tparm '/' and '%' operators to guard against
    SIGFPE on dividing INT_MIN by -1 (report/testcase by Martin Mirchev).
  + add sanity-checks to _nc_infotocap() when moving mandatory padding
    (report/testcase by Martin Mirchev).
  + reorder check for missing '\0' in str_table and a strlen() call
    (report/testcase by Martin Mirchev).
  + add check in decode_xterm_X10() to ensure that enough bytes were
    read (report by Martin Mirchev).
  + use CLOCK_MONOTONIC instead of CLOCK_REALTIME when it is available
    (patch by Yeatol).
  + add limit check in lib_add_wch.c (report/testcase by Serhiy
    Storchaka),
  + improve cleanup on EOF in next_char (report by Oliver Zhang).
  + improve fix for filling cells for multicolumn characters in
    lib_addch.c (patch by Vassili Courzakis).
  + fixes for tvi910, tvi950, wy100 (patch by Adam Di Carlo)
- Add ncurses patch 20261031
  + improve configure check for wcwidth, for msys2 port.
  + modify configure check for multiuser systems to use getent if it is
    available.
  + remove obsolete configure macro CF_LDFLAGS_STATIC (prompted by
    discussion with Julian Waters).
  + modify convert_strings to disallow overlapping strings.
  + add null-pointer checks for terminfo/termcap function parameters.
  + pad str_table with a '\0' in case of malformed terminfo data which
    omits a '\0' on the final string (report/testcase by Can Ozkan).
- Add ncurses patch 20261024
  + modify initialization for term-driver return terminfo data when given
    a name in $TERM unless _nc_console_vt_supported() returns true, as in
    the missing-name branch (patch by Daniel Aliev).
  + correct initialization of fallback entries which using term-driver
    configuration (patch by Daniel Aliev).
  + correct limit check in lib_ins_wch.c (patch by Serhiy Storchaka,
    cf: 20260815)
  + initialize sp->_wacs_map for each screen, rather than reusing data,
    to help with delscreen (patch by Serhiy Storchaka, cf: 20260523).
  + improve ripoff window cleanup in delwin (report by Serhiy Storchaka).
  + fix a duplicate declaration of _nc_gettimeofday() (report by Abril
    Rincon Blanco).
  + improve check for end of file in next_char() (report by Lingfeng
    Chen).

==== patterns-kde ====

- Have the main pattern recommend opensuse-welcome. This used to be pulled in
  by the various X-related patterns (IIRC last via games), which was cleaned
  up. As we have no underlying pattern for graphical systems anymore, desktops
  need to pull it in directly.

==== poppler ====
Version update (26.10.0 -> 26.11.0)

- Update to version 26.11.0:
  * Core:
    + Fix subsetting annotations with multiline content
    + NSS: Fix crash if creating the hash context fails
    + Fix crash when saving documents with special forms
    + Properly apply password length limit
    + Annot: Fix the text width of widgets rotated 180 degrees
    + FlateStream::rewind: Don't consider the empty stream failing when
    reviwnding it
    + TextStringToUtf8: Fix PDFDocEncoding conversion
    + Internal code improvements
    + Fix crashes in malformed documents
  * Utils:
    + Increase max password length
    + Pdfsig: Allow to give multiple nss passwords
    + Pdfsig: Allow to input the password interactively
  * Qt6:
    + Expose the asset of RichMedia instances
    + Fix leak of RichMedia activation and deactivation
    + Check that Catalog::getForm() returns a Form before using it
  * Qt5:
    + Check that Catalog::getForm() returns a Form before using it
    + Fix leak of RichMedia activation and deactivation
- Update version dependencies according to meson.build.
- Bump soname following upstream changes.

==== poppler-qt6 ====
Version update (26.10.0 -> 26.11.0)

- Update to version 26.11.0:
  * Core:
    + Fix subsetting annotations with multiline content
    + NSS: Fix crash if creating the hash context fails
    + Fix crash when saving documents with special forms
    + Properly apply password length limit
    + Annot: Fix the text width of widgets rotated 180 degrees
    + FlateStream::rewind: Don't consider the empty stream failing when
    reviwnding it
    + TextStringToUtf8: Fix PDFDocEncoding conversion
    + Internal code improvements
    + Fix crashes in malformed documents
  * Utils:
    + Increase max password length
    + Pdfsig: Allow to give multiple nss passwords
    + Pdfsig: Allow to input the password interactively
  * Qt6:
    + Expose the asset of RichMedia instances
    + Fix leak of RichMedia activation and deactivation
    + Check that Catalog::getForm() returns a Form before using it
  * Qt5:
    + Check that Catalog::getForm() returns a Form before using it
    + Fix leak of RichMedia activation and deactivation
- Update version dependencies according to meson.build.
- Bump soname following upstream changes.

==== python-cffi ====
Version update (2.0.0 -> 2.1.1)

- update to 2.1.1:
  * Minimize internal Python API usage for interpreter and
    thread state sampling where possible.
  * Added the cffi-gen-src command-line tool
  * Added support for Python 3.15 and support for C extensions
    generated by CFFI to target the new abi3t free-threaded ABI. (#232)
  * Avoid crashes inside of __delitem__. (#235)
  * Avoid “string too big” error under MSVC. (#167)
  * Fix mingw builds. (#198)
- drop support-pycparser-3.patch (upstream)

==== python-oauthlib ====
Version update (4.0.0 -> 4.0.1)

- Update to 4.0.1:
  * CVE-2026-49272: Breaking: The device code flow token endpoint did
    not validate the device_code parameter, allowing a request with a known
    client_id and a bogus device_code to obtain a bearer token. (bsc#1288518)