Packages changed:
  SDL3 (3.4.12 -> 3.4.14)
  breeze6
  kernel-source (7.1.5 -> 7.1.6)
  libpsl (0.23.0 -> 0.23.1)
  libssh2_org
  open-isns (0.103+2.296d533bd52a -> 0.103+4.60de8b5)
  plasma6-integration
  plasma6-workspace
  python-pyzmq
  selinux-policy (20260727 -> 20260804)
  shadow (4.19.4 -> 4.20.0)
  xen

=== Details ===

==== SDL3 ====
Version update (3.4.12 -> 3.4.14)

- Update to release 3.4.14
  * GPU buffers and textures can have multiple read usages
  * Fixed X11 crash if the IME service was shutdown in the
    background
  * Fixed hang when hiding an X11 window on some window managers
  * Fixed Xbox controllers not being detected if SDL is built with
    GameInput support

==== breeze6 ====
Subpackages: breeze6-cursors breeze6-decoration breeze6-style breeze6-wallpapers

- Move Qt 5 style into a separate optional package

==== kernel-source ====
Version update (7.1.5 -> 7.1.6)

- Linux 7.1.6 (bsc#1012628).
- platform/x86/intel-uncore-freq: Fix current_freq_khz after
  CPU hotplug (bsc#1012628).
- sched_ext: Skip ops.set_weight() for disabled tasks
  (bsc#1012628).
- drm/virtio: fix deadlock in display_info_cb by removing hotplug
  from dequeue worker (bsc#1012628).
- seqlock: Allow UBSAN_ALIGNMENT to fail optimizing (bsc#1012628).
- KVM: x86: Check for invalid/obsolete root *after* making MMU
  pages available (bsc#1012628).
- KVM: x86: Only reset TSC Deadline Timer in apic_timer_expired
  on KVM_RUN (bsc#1012628).
- KVM: nVMX: Hide shadow VMCS right after VMCLEAR (bsc#1012628).
- KVM: x86/mmu: Fix use-after-free on vendor module reload
  (bsc#1012628).
- gpu: host1x: Fix use-after-free in
  host1x_bo_clear_cached_mappings (bsc#1012628).
- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin
  (bsc#1012628).
- xprtrdma: Clear receive-side ownership pointers on release
  (bsc#1012628).
- arm64: tegra: Remove fallback compatible for GPCDMA
  (bsc#1012628).
- Docs/admin-guide/cgroup-v2: fix memory.stat doc details
  (bsc#1012628).
- sched_ext: Annotate ksyncs with __rcu in alloc/free_kick_syncs()
  (bsc#1012628).
- arm64: tegra: Fix CPU compatible string to cortex-a78ae on
  Tegra234 (bsc#1012628).
- xfrm: propagate -EINPROGRESS from validate_xmit_xfrm()
  (bsc#1012628).
- xfrm: fix stale skb->prev after async crypto steals a GSO
  segment (bsc#1012628).
- firmware: arm_ffa: Respect firmware advertised RX/TX buffer
  size limits (bsc#1012628).
- IB/mad: Drop unmatched RMPP responses before reassembly
  (bsc#1012628).
- mtd: virt_concat: fix use-after-free in
  mtd_virt_concat_destroy_joins() (bsc#1012628).
- mtd: virt_concat: fix use-after-free in
  mtd_virt_concat_destroy() (bsc#1012628).
- mtd: mtdswap: remove debugfs stats file on teardown
  (bsc#1012628).
- mtd: nand: mtk-ecc: stop on ECC idle timeouts (bsc#1012628).
- btrfs: reject free space cache with more entries than pages
  (bsc#1012628).
- btrfs: fix root leak if its reloc root is unexpected in
  merge_reloc_roots() (bsc#1012628).
- btrfs: fallback to transaction csum tree on a commit root csum
  miss (bsc#1012628).
- firmware: arm_ffa: Fix NULL dereference in
  ffa_partition_info_get() (bsc#1012628).
- sched_ext: Don't warn on core-sched forced idle in
  put_prev_task_scx() (bsc#1012628).
- reset: spacemit: k3: fix USB2 ahb reset (bsc#1012628).
- xfrm: fix sk_dst_cache double-free in xfrm_user_policy()
  (bsc#1012628).
- xfrm: reject optional IPTFS templates in outbound policies
  (bsc#1012628).
- RDMA/cma: Fix hardware address comparison length in netevent
  callback (bsc#1012628).
- RDMA/irdma: Prevent rereg_mr for non-mem regions (bsc#1012628).
- RDMA/irdma: Remove redundant legacy_mode checks (bsc#1012628).
- RDMA/irdma: Prevent user-triggered null deref on QP create
  (bsc#1012628).
- RDMA/erdma: initialize ret for empty receive WR lists
  (bsc#1012628).
- RDMA/mana_ib: initialize err for empty send WR lists
  (bsc#1012628).
- RDMA/core: Fix memory leak in __ib_create_cq() on invalid cqe
  (bsc#1012628).
- RDMA/hns: Fix potential integer overflow in mhop hem cleanup
  (bsc#1012628).
- RDMA/siw: publish QP after initialization (bsc#1012628).
- mtd: fix double free and WARN_ON in add_mtd_device() error paths
  (bsc#1012628).
- selftests/alsa: Fix memory leak in find_controls error path
  (bsc#1012628).
- RDMA/irdma: Prevent overflows in memory contiguity checks
  (bsc#1012628).
- xfrm: clear mode callbacks after failed mode setup
  (bsc#1012628).
- xfrm: iptfs: propagate SKBFL_SHARED_FRAG in
  iptfs_skb_add_frags() (bsc#1012628).
- xfrm6: clear dst.dev on error to avoid double netdev_put in
  xfrm6_fill_dst() (bsc#1012628).
- xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild
  reinsert (bsc#1012628).
- wifi: mac80211: allocate backup ieee80211_nan_sched_cfg off
  stack (bsc#1012628).
- ALSA: usb-audio: Fix imbalance per-channel volume of sticky
  mixers (bsc#1012628).
- wifi: cfg80211: cancel sched scan results work on unregister
  (bsc#1012628).
- wifi: ipw2100: fix potential memory leak in
  ipw2100_pci_init_one() (bsc#1012628).
- wifi: cfg80211: Fix an error handling path in
  cfg80211_wext_siwscan() (bsc#1012628).
- wifi: mac80211_hwsim: clamp virtio RX length before skb_put
    ... changelog too long, skipping 1266 lines ...
- commit 05b8588

==== libpsl ====
Version update (0.23.0 -> 0.23.1)

- Update to version 0.23.1:
  * Fix reproducible builds, a regression introduced in 0.23.0
  * psl-make-dafsa embeds only the basename of the input file
  * Allow explicitly disabling fuzzing at configure time

==== libssh2_org ====

- Security fixes:
  * CVE-2026-58050: Attacker controlled attribute count from a
    publickey-subsystem response is used without bounds checking
    and can cause to a heap buffer overflow in a connecting libssh2
    client (bsc#1269568)
  * CVE-2026-58051: Public key list is increased and does not
    zero-initialized new entries, which can cause an uninitialized
    pointer to be freed when a malformed response is sent by an SSH
    server (bsc#1269567)
  * Add patches
  - libssh2-CVE-2026-58050.patch
  - libssh2-CVE-2026-58051.patch
- Security fixes:
  * CVE-2026-66032: Arbitrary code execution via double-free in
    SFTP session (bsc#1272737)
  * CVE-2026-66033: Denial of Service via integer underflow in
    AES-GCM cipher negotiation (bsc#1272736)
  * CVE-2026-66034: Information disclosure and potential arbitrary
    code execution via heap out-of-bounds read (bsc#1272735)
  * CVE-2026-66035: Arbitrary code execution via heap buffer
    overflow during SSH negotiation (bsc#1272734)
  * Add patches:
  - libssh2-CVE-2026-66032.patch
  - libssh2-CVE-2026-66033.patch
  - libssh2-CVE-2026-66034.patch
  - libssh2-CVE-2026-66035.patch

==== open-isns ====
Version update (0.103+2.296d533bd52a -> 0.103+4.60de8b5)

- Update to version 0.103+4.60de8b5:
  * Fix issue in error path causing double-free.
    Fixes issue CVE-2026-55995 bsc#1268685

==== plasma6-integration ====

- Put Qt 5 integration into a separate optional package

==== plasma6-workspace ====
Subpackages: plasma6-session plasma6-workspace-libs

- sddm.conf: Set plasmawayland.desktop as default session
- No longer recommend plasma6-session-x11

==== python-pyzmq ====

- Pin scikit-build-core's CMake build directory for reproducible builds.
  Otherwise it uses a random tempdir whose path leaks into the
  debug info that the linker hashes into the GNU build-id note of
  the later-stripped _zmq*.so, making the build non-reproducible
  even though the actual code is identical.

==== selinux-policy ====
Version update (20260727 -> 20260804)
Subpackages: selinux-policy-targeted

- Update to version 20260804:
  * Use NetworkManager_t instead of networkmanager_t
  * Changes adapting to bind packages with suffixes
  * Dontaudit unconfined_t map its private directories
  * Support cronie create crontab backups
  * Allow nfsidmapd read virt lib files
  * Allow sysadm_t run and read/write networkmanager bpf programs
  * Allow dhcpc_hook_t connect to init_t over a unix stream socket
  * Allow unconfined_t mounton its lnk_files
  * Allow wireguard read cgroup files
  * Label /usr/local/share/man with man_t
  * Allow pcscd get attributes of a pty filesystem
  * Allow geoclue read cgroup files
  * Allow init_t nnp domain transition to postgresql_t
  * Move bootupd systemd interface to 2 optional blocks
  * Allow net_admin to the nfsd_t domain
  * Allow kernel write to unconfined and sysadm users' keys
  * Allow staff user ioctl cockpit-session stream sockets
  * Allow the staff user mount on tmpfs directories
  * Allow staff user the dac_override capability in the user namespace
  * Allow aide get attributes of all filesystems
  * Make insights_client_t accessible from the system cronjob
  * Support systemtap on a UEFI+SecureBoot system
  * Allow systemd-coredump signull spc container
  * Allow dhcpcd hook scripts read generic files in /proc
- Syncing with upstream rawhide selinux-policy up to:
  * 5c9bff8fbdaeb41b724b68937c706dc5e42a490a

==== shadow ====
Version update (4.19.4 -> 4.20.0)
Subpackages: login_defs shadow-pw-mgmt

- Update to 4.20.0:
  * Removals:
    The following programs and features were deprecated in 4.19
    or earlier, and have been removed in 4.20.
    + expiry(1) (deprecated in 4.19). See #1481 and #1432.
    + login.defs(5): ENCRYPT_METHOD: DES (deprecated in 4.19). See #1456.
    + login.defs(5): ENCRYPT_METHOD: MD5 (deprecated in 4.19). See #1457.
    + login.defs(5): MD5_CRPYT_ENAB (deprecated since the dinosaurs were around). See #1455.
    + shadow(5): .sp_min (deprecated in 4.19). See #1482.
    This also includes the following removals:
  - chage(1): -m,--mindays (also the interactive version)
  - passwd(1): -n,--mindays
  - login.defs(5): PASS_MIN_DAYS
    This feature is considered a vulnerability, and was removed without replacement.
    Programs will now fail when any of those flags or variable are specified.
    This is intentional, and should help identify any scripts that rely on
    these.
    + groupmems(8) (deprecated in 4.19). See #1343 and #1601. Use usermod(8) instead.
    + logoutd(8) (deprecated in 4.19). See #999 and #1344.
  * Defaults:
    The following default values were changed.
    + login.defs(5): Remove defaults for password expiration (PASS_MAX_DAYS, PASS_WARN_AGE). See #1428.
    + login.defs(5): ENCRYPT_METHOD: Default to SHA512 (previously, it was DES). See #1278 and #1454.
    Users should still explicitly specify it, since other programs that read login.defs(5) may still default to DES.
  * Features:
    The following features that were optional in 4.19 are now unconditionally supported in 4.20.
    + SHA256, SHA512 See #1278 and #1452.
  * Regressions:
    Some regressions have been introduced (as side effects of bug fixes) and they're here to stay. Users must adapt.
    + `su - <USERNAME>` as root brings inappropriate ioctl for device #1704
    + `usermod --unlock` on an account without valid password will exit with status 20 instead of print a warning #1706
  * Dependencies:
    + We've removed an unused dependency (libattr). See #1473.
  * Deprecations:
    No new deprecations since 4.19. However, we maintain the deprecations from then.
- Refresh patches:
  * shadow-login_defs-comments.patch
    Line offsets and dropping MD5_CRYPT_ENAB.
  * shadow-login_defs-suse.patch
    Drop PASS_MAX_DAYS/PASS_MIN_DAYS/PASS_WARN_AGE. We set them to 0 earlier to
    disable them because PAM handles it. So we have the same effect still.
    Drop PASS_MAX_LEN since DES support got removed.
    Drop MD5_CRYPT_ENAB.
    PASS_CHANGE_TRIES got dropped upstream.
  * shadow-login_defs-unused-by-pam.patch
    Drop PASS_MAX_DAYS, PASS_MIN_DAYS, PASS_WARN_AGE, PASS_MAX_LEN, and PASS_MIN_LEN.
  * shadow-util-linux.patch
- Add PASS_ALWAYS_WARN, PASS_CHANGE_TRIES, PASS_MAX_DAYS, PASS_MIN_LEN,
  PASS_WARN_AGE, OBSCURE_CHECKS_ENAB to false positives in shadow-login_defs-check.sh
- Add shadow-4.20-stdint.patch to fix an include

==== xen ====

- Re-enable aarch64 builds