Packages changed: ffmpeg-8 mutter nautilus (50.3.1 -> 50.4) openSUSE-release (20261012 -> 20261013) phonon-vlc-qt5 phonon-vlc-qt6 python-anyio (4.14.2 -> 4.15.1) python313 (3.13.15 -> 3.13.16) python313-core (3.13.15 -> 3.13.16) vlc zbar (0.23.93 -> 0.23.95) zoo === Details === ==== ffmpeg-8 ==== Subpackages: libavcodec62 libavfilter11 libavformat62 libavutil60 libswresample6 libswscale9 - Enable RealAudio Lossless, RealVideo 3.0 and 4.0 decoders. ==== mutter ==== Subpackages: mutter-lang - Drop 5370.patch: It fixes emacs, but breaks copy/paste from firefox and others (boo#1284143). ==== nautilus ==== Version update (50.3.1 -> 50.4) Subpackages: gnome-shell-search-provider-nautilus libnautilus-extension4 nautilus-lang - Update to version 50.4: * Bugfixes: + Fix unwritable file indicator + Focus Replace button by default in conflict dialog + Disable markup syntax on property extension rows + Fix leak in audio/video extension + Fix various leaks and errors without reports + Don't abort on invalid boolean metadata + Fix properties dialog sometimes opening too small * Updated translations. - Update version dependencies according to meson.build. ==== openSUSE-release ==== Version update (20261012 -> 20261013) Subpackages: openSUSE-release-appliance-custom openSUSE-release-dvd - automatically generated by openSUSE-release-tools/pkglistgen ==== phonon-vlc-qt5 ==== Subpackages: phonon-vlc-lang - Update Requires to new vlc-plugins-desktop, removes installation of GUI, for headless installations, or users that don't actually * use* vlc as a video player, and only want it for the phonon backend. https://build.opensuse.org/request/show/1382584 ==== phonon-vlc-qt6 ==== - Update Requires to new vlc-plugins-desktop, removes installation of GUI, for headless installations, or users that don't actually * use* vlc as a video player, and only want it for the phonon backend. https://build.opensuse.org/request/show/1382584 ==== python-anyio ==== Version update (4.14.2 -> 4.15.1) - Add patch tls.patch to fix test failure with recent pythons - Update to 4.15.1: * Implemented a compatibility fix for supporting direct access of anyio.* submodules from the main package even when those submodules were not directly imported first * Added support for the newer keyword-only arguments on anyio.Path methods to match the standard library pathlib.Path * Added amap, gather, and as_completed utility functions to simplify common patterns * Added --anyio-mode command-line option as an alternative to the anyio_mode ini setting, and fix the pytest plugin's auto mode detection to recognize the mode when set via either mechanism(e.g: pytest_asyncio). * Added the anyio.Future synchronization primitive which behaves similar to asyncio.Future, allowing tasks to wait for a value (or exception) from another task * Added guidance for managing multiple memory object stream producers and consumers with cloned streams * Added StapledObjectStream.send_nowait() that delegates to the underlying ObjectSendStream, if it implements it * Changed the default name for a task spawned with TaskGroup.create_task(func()) to match the default task name for the analogous task spawned with TaskGroup.start_soon(func) or TaskGroup.start(func) in more situations. * Changed the anyio and anyio.abc modules to lazily import the necessary submodules. * Fixed SpooledTemporaryFile.readinto() and readinto1() reading twice before rollover, so the destination buffer was overwritten by the second read and the file position advanced twice, silently losing data * Fixed anyio.run leaking, or at least, delaying collection of loop and root_task due to the root task being cached in a RunVar. * Fixed UNIXSocketStream.aclose() raising asyncio.InvalidStateError when a concurrent receive or send operation had just been cancelled on the asyncio backend * Fixed the pytest plugin importing the deprecated _pytest.python.CallSpec2 alias * Fixed an asyncio worker thread race that could raise RuntimeError when the event loop closed between checking its state and scheduling the worker result * Fixed inconsistencies between Trio and asyncio when target TaskGroup is cancelled before a task created with .start() calls TaskStatus.started() * Fixed TemporaryDirectory not cleaning up when the host task was cancelled while exiting the context manager, as the cleanup now runs in a shielded cancel scope - Drop patches: * robust_test_shielded_cancel_sleep_time.patch * fix-uvloop-closed-loop-race.patch - Refresh patch extend_timeouts.patch ==== python313 ==== Version update (3.13.15 -> 3.13.16) Subpackages: python313-curses python313-dbm python313-tk python313-x86-64-v3 - Update to 3.13.16: - Security - gh-158446: Fix a crash or incorrect output that could occur when formatting a float or complex with a precision close to the platform’s INT_MAX. PyOS_double_to_string() now raises ValueError for any precision of that magnitude, regardless of presentation type or value, as the format string parsers already did for precisions above INT_MAX. - gh-157190: Fixed a vulnerability in the tarfile data and tar extraction filters where a crafted archive using a hard link to a symbolic link could change the permissions and modification time of a file outside the destination directory, and expose its contents inside the extracted tree. This addresses CVE 2026-82049. (bsc#1280459, CVE-2026-82049) - gh-156793: asyncio: loop.start_tls() and loop.create_connection() now validate the server_hostname argument if an ssl.SSLContext is passed with check_hostname set to True. (bsc#1283826, CVE-2026-19553) - gh-156793: ssl.SSLContext.wrap_bio() now validates its server_side, server_hostname and session arguments similar to ssl.SSLContext.wrap_socket(). - In particular, a context with check_hostname enabled and no server_hostname passed to wrap_bio() now raises ValueError instead of completing a handshake that verified the certificate chain without verifying the peer’s identity, with no indication that the check had been skipped. - gh-157265: In tarfile, when extracting a link falls back to extracting a member of the archive, skip the member when the filter function returns None when called with the extracted member’s name replaced with the link’s. - gh-157190: Fixed a vulnerability in the tarfile data and tar extraction filters where a crafted archive using a hard link to a symbolic link could change the permissions and modification time of a file outside the destination directory, and expose its contents inside the extracted tree. This addresses CVE 2026-82049. (bsc#1280459, CVE-2026-82049) - gh-157953: Update bundled libexpat to version 2.8.5. - gh-156002: Bound the amount of data zipfile decompresses per read for members compressed with bzip2, LZMA, or Zstandard, matching the existing limit for deflate. A small archive member could previously expand into an unbounded allocation even when read in small chunks. (bsc#1277111, CVE-2026-15310) - gh-155999: Fix the tarfile tar and data extraction filters creating directories outside the destination for members whose name leaves the destination and returns to it, such as ../evil/../dest/sub/file. The containment check used the resolved path, but intermediate directories were created from the name as given. (bsc#1276227, CVE-2026-19672) - gh-156293: Fix a crash in ssl when an sni_callback switches a connection to another SSLContext and the context that carries the callback is no longer referenced by the application. Servers that keep their sni_callback context alive (the usual case when it wraps the listening socket or is stored on the server object) were not affected. This addresses CVE 2026-19445. (bsc#1283969, CVE-2026-19445) - gh-155292: Change the stringprep module and encodings.idna codec to not consider Unicode codepoint attributes beyond those defined in RFC 3454. (bsc#1276226, CVE-2026-17084) - gh-155694: Fix CVE 2026-15806 by scoping HTTPPasswordMgr credentials to the URL scheme, preventing credentials stored for an HTTPS URL from being used for a matching HTTP URL, while URIs without a scheme continue to match any scheme (bsc#1276223, CVE-2026-15806). - Core and Builtins - gh-158364: Fix crash when sys._current_frames() or sys._current_exceptions() is called while another interpreter is running. - gh-158254: Reverse iterators over a dict and its views now raise RuntimeError if the dictionary’s keys change during iteration, like forward iterators, instead of yielding entries for the new keys. - gh-154175: Move GIL drop request bit fetching to live under the GIL so the PyThreadState it accesses is guaranteed not to be deallocated. Deallocation could occur when a daemon thread was shutting down after the main thread. - gh-156091: Fix a crash when compiling deeply nested inlined list, set, or dict comprehensions. A SyntaxError is now raised when the nesting exceeds the compiler’s static block limit. - gh-156894: Fix the position of syntax errors which cover a range if the line contains non-ASCII characters before the error. - gh-155525: Fix quadratic-time tokenization of modules containing many f-strings. - gh-156114: Fix a crash in the perf trampoline when a code object has a name or filename that cannot be encoded to UTF-8. Patched by Shamil Abdulaev. - gh-156196: A failed assignment to an attribute defined with PyMemberDef of type Py_T_LONG, Py_T_LONGLONG, Py_T_PYSSIZET or Py_T_DOUBLE no longer changes its value. - gh-156189: Fix a crash when deleting the f_trace_opcodes attribute of a frame object. It now raises AttributeError. - gh-155752: Fix a crash when a types.GenericAlias argument gains a __typing_subst__ hook after the alias parameters have been cached. - gh-155526: Fix spurious OverflowError for abs(nanj) in case ... changelog too long, skipping 452 lines ... - Update sphinx9-runtime-node.patch ==== python313-core ==== Version update (3.13.15 -> 3.13.16) Subpackages: libpython3_13-1_0 libpython3_13-1_0-x86-64-v3 python313-base python313-base-x86-64-v3 python313-devel - Update to 3.13.16: - Security - gh-158446: Fix a crash or incorrect output that could occur when formatting a float or complex with a precision close to the platform’s INT_MAX. PyOS_double_to_string() now raises ValueError for any precision of that magnitude, regardless of presentation type or value, as the format string parsers already did for precisions above INT_MAX. - gh-157190: Fixed a vulnerability in the tarfile data and tar extraction filters where a crafted archive using a hard link to a symbolic link could change the permissions and modification time of a file outside the destination directory, and expose its contents inside the extracted tree. This addresses CVE 2026-82049. (bsc#1280459, CVE-2026-82049) - gh-156793: asyncio: loop.start_tls() and loop.create_connection() now validate the server_hostname argument if an ssl.SSLContext is passed with check_hostname set to True. (bsc#1283826, CVE-2026-19553) - gh-156793: ssl.SSLContext.wrap_bio() now validates its server_side, server_hostname and session arguments similar to ssl.SSLContext.wrap_socket(). - In particular, a context with check_hostname enabled and no server_hostname passed to wrap_bio() now raises ValueError instead of completing a handshake that verified the certificate chain without verifying the peer’s identity, with no indication that the check had been skipped. - gh-157265: In tarfile, when extracting a link falls back to extracting a member of the archive, skip the member when the filter function returns None when called with the extracted member’s name replaced with the link’s. - gh-157190: Fixed a vulnerability in the tarfile data and tar extraction filters where a crafted archive using a hard link to a symbolic link could change the permissions and modification time of a file outside the destination directory, and expose its contents inside the extracted tree. This addresses CVE 2026-82049. (bsc#1280459, CVE-2026-82049) - gh-157953: Update bundled libexpat to version 2.8.5. - gh-156002: Bound the amount of data zipfile decompresses per read for members compressed with bzip2, LZMA, or Zstandard, matching the existing limit for deflate. A small archive member could previously expand into an unbounded allocation even when read in small chunks. (bsc#1277111, CVE-2026-15310) - gh-155999: Fix the tarfile tar and data extraction filters creating directories outside the destination for members whose name leaves the destination and returns to it, such as ../evil/../dest/sub/file. The containment check used the resolved path, but intermediate directories were created from the name as given. (bsc#1276227, CVE-2026-19672) - gh-156293: Fix a crash in ssl when an sni_callback switches a connection to another SSLContext and the context that carries the callback is no longer referenced by the application. Servers that keep their sni_callback context alive (the usual case when it wraps the listening socket or is stored on the server object) were not affected. This addresses CVE 2026-19445. (bsc#1283969, CVE-2026-19445) - gh-155292: Change the stringprep module and encodings.idna codec to not consider Unicode codepoint attributes beyond those defined in RFC 3454. (bsc#1276226, CVE-2026-17084) - gh-155694: Fix CVE 2026-15806 by scoping HTTPPasswordMgr credentials to the URL scheme, preventing credentials stored for an HTTPS URL from being used for a matching HTTP URL, while URIs without a scheme continue to match any scheme (bsc#1276223, CVE-2026-15806). - Core and Builtins - gh-158364: Fix crash when sys._current_frames() or sys._current_exceptions() is called while another interpreter is running. - gh-158254: Reverse iterators over a dict and its views now raise RuntimeError if the dictionary’s keys change during iteration, like forward iterators, instead of yielding entries for the new keys. - gh-154175: Move GIL drop request bit fetching to live under the GIL so the PyThreadState it accesses is guaranteed not to be deallocated. Deallocation could occur when a daemon thread was shutting down after the main thread. - gh-156091: Fix a crash when compiling deeply nested inlined list, set, or dict comprehensions. A SyntaxError is now raised when the nesting exceeds the compiler’s static block limit. - gh-156894: Fix the position of syntax errors which cover a range if the line contains non-ASCII characters before the error. - gh-155525: Fix quadratic-time tokenization of modules containing many f-strings. - gh-156114: Fix a crash in the perf trampoline when a code object has a name or filename that cannot be encoded to UTF-8. Patched by Shamil Abdulaev. - gh-156196: A failed assignment to an attribute defined with PyMemberDef of type Py_T_LONG, Py_T_LONGLONG, Py_T_PYSSIZET or Py_T_DOUBLE no longer changes its value. - gh-156189: Fix a crash when deleting the f_trace_opcodes attribute of a frame object. It now raises AttributeError. - gh-155752: Fix a crash when a types.GenericAlias argument gains a __typing_subst__ hook after the alias parameters have been cached. - gh-155526: Fix spurious OverflowError for abs(nanj) in case ... changelog too long, skipping 452 lines ... - Update sphinx9-runtime-node.patch ==== vlc ==== Subpackages: libvlc5 libvlccore9 vlc-codec-gstreamer vlc-lang vlc-noX vlc-plugins-desktop vlc-qt - Add pkgconfig(vpl) BuildRequires: Build qsv plugin. ==== zbar ==== Version update (0.23.93 -> 0.23.95) - drop libzbarqt0 from baselibs.conf: the Qt subpackages are no longer built, so the stale entry fails source validation - drop unused BuildRequires: libtool (meson build, never invoked), pkgconfig(ImageMagick) (GraphicsMagick preferred and used), pkgconfig(ice) and pkgconfig(sm) (never probed or linked by meson) - add %check section running the upstream meson test suite under xvfb-run (display tests need an X server) - drop the Qt bindings conditional: the %bcond_with qt branch was dead (only active for suse_version < 1600, which no built distro has) and its -Dqt flag logic was inverted, so Qt never built anywhere - Update to 0.23.95: * fix: undefined behavior (UBSan) warnings in QR decoder and scanner * ci: address some issues for artifact generation * v4l2: prefer video fourcc with maximum fps * add a .editorconfig to define zbar's codingstyle * Add a SECURITY.md file and intended audience to README.md * README: update files now that Windows and MacOS have ImageMagick * INSTALL.md: update build instructions and move Windows ones to here * ci: update github actions after meson changes * ci: add support for running unit tests on Windows and MacOS * ci: build static Windows release executables * build: drop Autoconf pkg-config templates * zbar: add a feature to select between static, dynamic or both lib types * zbar.spec.in: update it from Fedora repository and make it work * qrcode: reserve extra spaces for NUL separators * zbarimg: release image on error paths * zbarimg: fix potential memory leak * zbarcam-qt: fix wayland SIGSEGV at init * zbarcam/zbarcam-gtk: fix compilation against GTK2 * python: avoid Py_SIZE on exact integers * java: Fix an obsolete call * Symbol.h: Fix warnings with newer g++/stdlib++ * qt/QZBarThread.cpp: handle fourcc the right way * img_scanner: include stddef for ptrdiff_t * sqcode: fix memory leak in _zbar_sq_decode * qrdectxt: Disallow 0x80 in text_is_big5() and make more readable * qrdectxt: Fix Big5 pre-validation * image: minor change to length calculation logic * symbol: Fix base64_encode to correctly encode bytes above 0x7F * qr: preserve edge points to avoid corruption * qr: avoid reading an uninitialized sa[] slot on a malformed S-A index * fix pointer-overflow UB in movedelta causing SIGSEGV * keep the code93 and databar edge sums out of signed shifts * check decode_e() results before shifting them into a signature - Remove upstreamed zbar-configure.patch - Remove upstreamed zbar-pkgconfig.patch ==== zoo ==== - Add %check section with an archive round-trip smoke test (create, list, extract and compare a test archive, plus a fiz directory scan); upstream has no testsuite. - Modernize License tag to the SPDX LicenseRef form (spec-cleaner).