Packages changed: MicroOS-release (20261012 -> 20261013) ffmpeg-8 phonon-vlc-qt6 python313 (3.13.15 -> 3.13.16) python313-core (3.13.15 -> 3.13.16) vlc === Details === ==== MicroOS-release ==== Version update (20261012 -> 20261013) Subpackages: MicroOS-release-appliance MicroOS-release-dvd - automatically generated by openSUSE-release-tools/pkglistgen ==== ffmpeg-8 ==== Subpackages: libavcodec62 libavfilter11 libavformat62 libavutil60 libswresample6 libswscale9 - Enable RealAudio Lossless, RealVideo 3.0 and 4.0 decoders. ==== phonon-vlc-qt6 ==== - Update Requires to new vlc-plugins-desktop, removes installation of GUI, for headless installations, or users that don't actually * use* vlc as a video player, and only want it for the phonon backend. https://build.opensuse.org/request/show/1382584 ==== python313 ==== Version update (3.13.15 -> 3.13.16) - Update to 3.13.16: - Security - gh-158446: Fix a crash or incorrect output that could occur when formatting a float or complex with a precision close to the platform’s INT_MAX. PyOS_double_to_string() now raises ValueError for any precision of that magnitude, regardless of presentation type or value, as the format string parsers already did for precisions above INT_MAX. - gh-157190: Fixed a vulnerability in the tarfile data and tar extraction filters where a crafted archive using a hard link to a symbolic link could change the permissions and modification time of a file outside the destination directory, and expose its contents inside the extracted tree. This addresses CVE 2026-82049. (bsc#1280459, CVE-2026-82049) - gh-156793: asyncio: loop.start_tls() and loop.create_connection() now validate the server_hostname argument if an ssl.SSLContext is passed with check_hostname set to True. (bsc#1283826, CVE-2026-19553) - gh-156793: ssl.SSLContext.wrap_bio() now validates its server_side, server_hostname and session arguments similar to ssl.SSLContext.wrap_socket(). - In particular, a context with check_hostname enabled and no server_hostname passed to wrap_bio() now raises ValueError instead of completing a handshake that verified the certificate chain without verifying the peer’s identity, with no indication that the check had been skipped. - gh-157265: In tarfile, when extracting a link falls back to extracting a member of the archive, skip the member when the filter function returns None when called with the extracted member’s name replaced with the link’s. - gh-157190: Fixed a vulnerability in the tarfile data and tar extraction filters where a crafted archive using a hard link to a symbolic link could change the permissions and modification time of a file outside the destination directory, and expose its contents inside the extracted tree. This addresses CVE 2026-82049. (bsc#1280459, CVE-2026-82049) - gh-157953: Update bundled libexpat to version 2.8.5. - gh-156002: Bound the amount of data zipfile decompresses per read for members compressed with bzip2, LZMA, or Zstandard, matching the existing limit for deflate. A small archive member could previously expand into an unbounded allocation even when read in small chunks. (bsc#1277111, CVE-2026-15310) - gh-155999: Fix the tarfile tar and data extraction filters creating directories outside the destination for members whose name leaves the destination and returns to it, such as ../evil/../dest/sub/file. The containment check used the resolved path, but intermediate directories were created from the name as given. (bsc#1276227, CVE-2026-19672) - gh-156293: Fix a crash in ssl when an sni_callback switches a connection to another SSLContext and the context that carries the callback is no longer referenced by the application. Servers that keep their sni_callback context alive (the usual case when it wraps the listening socket or is stored on the server object) were not affected. This addresses CVE 2026-19445. (bsc#1283969, CVE-2026-19445) - gh-155292: Change the stringprep module and encodings.idna codec to not consider Unicode codepoint attributes beyond those defined in RFC 3454. (bsc#1276226, CVE-2026-17084) - gh-155694: Fix CVE 2026-15806 by scoping HTTPPasswordMgr credentials to the URL scheme, preventing credentials stored for an HTTPS URL from being used for a matching HTTP URL, while URIs without a scheme continue to match any scheme (bsc#1276223, CVE-2026-15806). - Core and Builtins - gh-158364: Fix crash when sys._current_frames() or sys._current_exceptions() is called while another interpreter is running. - gh-158254: Reverse iterators over a dict and its views now raise RuntimeError if the dictionary’s keys change during iteration, like forward iterators, instead of yielding entries for the new keys. - gh-154175: Move GIL drop request bit fetching to live under the GIL so the PyThreadState it accesses is guaranteed not to be deallocated. Deallocation could occur when a daemon thread was shutting down after the main thread. - gh-156091: Fix a crash when compiling deeply nested inlined list, set, or dict comprehensions. A SyntaxError is now raised when the nesting exceeds the compiler’s static block limit. - gh-156894: Fix the position of syntax errors which cover a range if the line contains non-ASCII characters before the error. - gh-155525: Fix quadratic-time tokenization of modules containing many f-strings. - gh-156114: Fix a crash in the perf trampoline when a code object has a name or filename that cannot be encoded to UTF-8. Patched by Shamil Abdulaev. - gh-156196: A failed assignment to an attribute defined with PyMemberDef of type Py_T_LONG, Py_T_LONGLONG, Py_T_PYSSIZET or Py_T_DOUBLE no longer changes its value. - gh-156189: Fix a crash when deleting the f_trace_opcodes attribute of a frame object. It now raises AttributeError. - gh-155752: Fix a crash when a types.GenericAlias argument gains a __typing_subst__ hook after the alias parameters have been cached. - gh-155526: Fix spurious OverflowError for abs(nanj) in case ... changelog too long, skipping 452 lines ... - Update sphinx9-runtime-node.patch ==== python313-core ==== Version update (3.13.15 -> 3.13.16) Subpackages: libpython3_13-1_0 python313-base - Update to 3.13.16: - Security - gh-158446: Fix a crash or incorrect output that could occur when formatting a float or complex with a precision close to the platform’s INT_MAX. PyOS_double_to_string() now raises ValueError for any precision of that magnitude, regardless of presentation type or value, as the format string parsers already did for precisions above INT_MAX. - gh-157190: Fixed a vulnerability in the tarfile data and tar extraction filters where a crafted archive using a hard link to a symbolic link could change the permissions and modification time of a file outside the destination directory, and expose its contents inside the extracted tree. This addresses CVE 2026-82049. (bsc#1280459, CVE-2026-82049) - gh-156793: asyncio: loop.start_tls() and loop.create_connection() now validate the server_hostname argument if an ssl.SSLContext is passed with check_hostname set to True. (bsc#1283826, CVE-2026-19553) - gh-156793: ssl.SSLContext.wrap_bio() now validates its server_side, server_hostname and session arguments similar to ssl.SSLContext.wrap_socket(). - In particular, a context with check_hostname enabled and no server_hostname passed to wrap_bio() now raises ValueError instead of completing a handshake that verified the certificate chain without verifying the peer’s identity, with no indication that the check had been skipped. - gh-157265: In tarfile, when extracting a link falls back to extracting a member of the archive, skip the member when the filter function returns None when called with the extracted member’s name replaced with the link’s. - gh-157190: Fixed a vulnerability in the tarfile data and tar extraction filters where a crafted archive using a hard link to a symbolic link could change the permissions and modification time of a file outside the destination directory, and expose its contents inside the extracted tree. This addresses CVE 2026-82049. (bsc#1280459, CVE-2026-82049) - gh-157953: Update bundled libexpat to version 2.8.5. - gh-156002: Bound the amount of data zipfile decompresses per read for members compressed with bzip2, LZMA, or Zstandard, matching the existing limit for deflate. A small archive member could previously expand into an unbounded allocation even when read in small chunks. (bsc#1277111, CVE-2026-15310) - gh-155999: Fix the tarfile tar and data extraction filters creating directories outside the destination for members whose name leaves the destination and returns to it, such as ../evil/../dest/sub/file. The containment check used the resolved path, but intermediate directories were created from the name as given. (bsc#1276227, CVE-2026-19672) - gh-156293: Fix a crash in ssl when an sni_callback switches a connection to another SSLContext and the context that carries the callback is no longer referenced by the application. Servers that keep their sni_callback context alive (the usual case when it wraps the listening socket or is stored on the server object) were not affected. This addresses CVE 2026-19445. (bsc#1283969, CVE-2026-19445) - gh-155292: Change the stringprep module and encodings.idna codec to not consider Unicode codepoint attributes beyond those defined in RFC 3454. (bsc#1276226, CVE-2026-17084) - gh-155694: Fix CVE 2026-15806 by scoping HTTPPasswordMgr credentials to the URL scheme, preventing credentials stored for an HTTPS URL from being used for a matching HTTP URL, while URIs without a scheme continue to match any scheme (bsc#1276223, CVE-2026-15806). - Core and Builtins - gh-158364: Fix crash when sys._current_frames() or sys._current_exceptions() is called while another interpreter is running. - gh-158254: Reverse iterators over a dict and its views now raise RuntimeError if the dictionary’s keys change during iteration, like forward iterators, instead of yielding entries for the new keys. - gh-154175: Move GIL drop request bit fetching to live under the GIL so the PyThreadState it accesses is guaranteed not to be deallocated. Deallocation could occur when a daemon thread was shutting down after the main thread. - gh-156091: Fix a crash when compiling deeply nested inlined list, set, or dict comprehensions. A SyntaxError is now raised when the nesting exceeds the compiler’s static block limit. - gh-156894: Fix the position of syntax errors which cover a range if the line contains non-ASCII characters before the error. - gh-155525: Fix quadratic-time tokenization of modules containing many f-strings. - gh-156114: Fix a crash in the perf trampoline when a code object has a name or filename that cannot be encoded to UTF-8. Patched by Shamil Abdulaev. - gh-156196: A failed assignment to an attribute defined with PyMemberDef of type Py_T_LONG, Py_T_LONGLONG, Py_T_PYSSIZET or Py_T_DOUBLE no longer changes its value. - gh-156189: Fix a crash when deleting the f_trace_opcodes attribute of a frame object. It now raises AttributeError. - gh-155752: Fix a crash when a types.GenericAlias argument gains a __typing_subst__ hook after the alias parameters have been cached. - gh-155526: Fix spurious OverflowError for abs(nanj) in case ... changelog too long, skipping 452 lines ... - Update sphinx9-runtime-node.patch ==== vlc ==== Subpackages: libvlc5 libvlccore9 vlc-noX vlc-plugins-desktop - Add pkgconfig(vpl) BuildRequires: Build qsv plugin.