Packages changed:
  MozillaFirefox (140.0.2 -> 141.0)
  avahi
  avahi-glib2
  gdm
  ghostscript-fonts
  gstreamer (1.26.3 -> 1.26.4)
  gstreamer-plugins-bad (1.26.3 -> 1.26.4)
  gstreamer-plugins-base (1.26.3 -> 1.26.4)
  gstreamer-plugins-good (1.26.3 -> 1.26.4)
  gstreamer-plugins-libav (1.26.3 -> 1.26.4)
  gstreamer-plugins-ugly (1.26.3 -> 1.26.4)
  inkscape
  kernel-source (6.15.7 -> 6.15.8)
  libostree (2025.3 -> 2025.4)
  mozilla-nss (3.112 -> 3.113)
  mozjs128 (128.12.0 -> 128.13.0)
  openSUSE-release (20250725 -> 20250727)
  patterns-base
  patterns-gnome
  pixman
  poppler
  poppler-qt6
  python-Babel
  python-kiwi (10.2.28 -> 10.2.29)
  sdl2-compat
  sysuser-tools
  virtualbox (7.1.10 -> 7.1.12a)
  virtualbox-kmp (7.1.10_k6.15.7_1 -> 7.1.12a_k6.15.8_1)

=== Details ===

==== MozillaFirefox ====
Version update (140.0.2 -> 141.0)
Subpackages: MozillaFirefox-branding-upstream MozillaFirefox-translations-common

- Mozilla Firefox 141.0
  * https://www.mozilla.org/en-US/firefox/141.0/releasenotes/
  MFSA 2025-56 (bsc#1246664)
  * CVE-2025-8027 (bmo#1968423)
    JavaScript engine only wrote partial return value to stack
  * CVE-2025-8028 (bmo#1971581)
    Large branch table could lead to truncated instruction
  * CVE-2025-8041 (bmo#1670725)
    Incorrect URL truncation in Firefox for Android
  * CVE-2025-8042 (bmo#1791322)
    Sandboxed iframe could start downloads
  * CVE-2025-8029 (bmo#1928021)
    javascript: URLs executed on object and embed tags
  * CVE-2025-8036 (bmo#1960834)
    DNS rebinding circumvents CORS
  * CVE-2025-8037 (bmo#1964767)
    Nameless cookies shadow secure cookies
  * CVE-2025-8030 (bmo#1968414)
    Potential user-assisted code execution in “Copy as cURL” command
  * CVE-2025-8043 (bmo#1970209)
    Incorrect URL truncation
  * CVE-2025-8031 (bmo#1971719)
    Incorrect URL stripping in CSP reports
  * CVE-2025-8032 (bmo#1974407)
    XSLT documents could bypass CSP
  * CVE-2025-8038 (bmo#1808979)
    CSP frame-src was not correctly enforced for paths
  * CVE-2025-8039 (bmo#1970997)
    Search terms persisted in URL bar
  * CVE-2025-8033 (bmo#1973990)
    Incorrect JavaScript state machine for generators
  * CVE-2025-8044 (bmo#1933572, bmo#1971116)
    Memory safety bugs fixed in Firefox 141 and Thunderbird 141
  * CVE-2025-8034 (bmo#1970422, bmo#1970422, bmo#1970422, bmo#1970422)
    Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR
    128.13, Thunderbird ESR 128.13, Firefox ESR 140.1,
    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8040 (bmo#1975058, bmo#1975058, bmo#1975998, bmo#1975998)
    Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird
    ESR 140.1, Firefox 141 and Thunderbird 141
  * CVE-2025-8035 (bmo#1975961, bmo#1975961, bmo#1975961)
    Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird
    ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox
    141 and Thunderbird 141
- requires NSS 3.113

==== avahi ====
Subpackages: avahi-lang libavahi-client3 libavahi-client3-32bit libavahi-common3 libavahi-common3-32bit libavahi-core7

- Add patch submitted to upstream at
  to enable building with Qt6 and add that flavor:
  0001-Enable-building-with-Qt6.patch
- Disable building the Qt5 flavor in SLE16.

==== avahi-glib2 ====
Subpackages: libavahi-glib1 libavahi-gobject0 libavahi-ui-gtk3-0

- Add patch submitted to upstream at
  to enable building with Qt6 and add that flavor:
  0001-Enable-building-with-Qt6.patch
- Disable building the Qt5 flavor in SLE16.

==== gdm ====
Subpackages: gdm-lang gdm-schema gdm-xdm-integration gdmflexiserver libgdm1 typelib-1_0-Gdm-1_0

- gdm-fingerprint.pamd: Fix inclusion of common-account instead
  of postlogin-account

==== ghostscript-fonts ====

- Remove the -converted subpackage that uses ttf-converter.
  Anyone using these fonts should actually use the
  urw-base35-fonts package.

==== gstreamer ====
Version update (1.26.3 -> 1.26.4)
Subpackages: gstreamer-lang gstreamer-utils libgstreamer-1_0-0 typelib-1_0-Gst-1_0

- Update to version 1.26.4:
  + Highlighted bugfixes in 1.26.4:
  - adaptivedemux2: Fixed reverse playback
  - d3d12screencapture: Add support for monitor add/remove in
    device provider
  - rtmp2src: various fixes to make it play back AWS medialive
    streams
  - rtph265pay: add profile-id, tier-flag, and level-id to output
    rtp caps
  - vp9parse: Fix handling of spatial SVC decoding
  - vtenc: Fix negotiation failure with profile=main-422-10
  - gtk4paintablesink: Add YCbCr memory texture formats and other
    improvements
  - livekit: add room-timeout
  - mp4mux: add TAI timestamp muxing support
  - rtpbin2: fix various race conditions, plus other bug fixes
    and performance improvements
  - threadshare: add a ts-rtpdtmfsrc element, implement run-time
    input switching in ts-intersrc
  - webrtcsink: fix deadlock on error setting remote description
    and other fixes.
  - cerbero: WiX installer: fix missing props files in the MSI
    packages
  - smaller macOS/iOS package sizes
  - Various bug fixes, build fixes, memory leak fixes, and other
    stability and reliability improvements
  + gstreamer:
  - tracers: Fix deadlock in latency tracer
  - Fix various valgrind/test errors when GST_DEBUG is enabled
  - More valgrind and test fixes
  - Various ASAN fixes

==== gstreamer-plugins-bad ====
Version update (1.26.3 -> 1.26.4)
Subpackages: gstreamer-plugins-bad-lang libgstadaptivedemux-1_0-0 libgstanalytics-1_0-0 libgstbadaudio-1_0-0 libgstbasecamerabinsrc-1_0-0 libgstcodecparsers-1_0-0 libgstcodecs-1_0-0 libgstcuda-1_0-0 libgstinsertbin-1_0-0 libgstisoff-1_0-0 libgstmpegts-1_0-0 libgstmse-1_0-0 libgstphotography-1_0-0 libgstplay-1_0-0 libgstplayer-1_0-0 libgstsctp-1_0-0 libgsttranscoder-1_0-0 libgsturidownloader-1_0-0 libgstva-1_0-0 libgstvulkan-1_0-0 libgstwayland-1_0-0 libgstwebrtc-1_0-0 libgstwebrtcnice-1_0-0

- Update to version 1.26.4:
  + avtp: crf: Setup socket during state change to ensure we handle
    failure
  + d3d12screencapture: Add support for monitor add/remove in
    device provider
  + mpegtsmux: fix double free caused by shared PMT descriptor
  + openh264: Ensure src_pic is initialized before use
  + rtmp2src: various fixes to make it play back AWS medialive
    streams
  + ssdobjectdetector: Use correct tensor data index for the scores
  + v4l2codecs: h265dec: Fix zero-copy of cropped window located at
    position 0,0
  + vp9parse: Fix handling of spatial SVC decoding
  + vp9parse: Revert "Always default to super-frame"
  + vtenc: Fix negotiation failure with profile=main-422-10
  + vulkan: Fix drawing too many triangles in fullscreenquad
  + vulkanfullscreenquad: add locks for synchronisation
  + Fix various valgrind/test errors when GST_DEBUG is enabled
  + More valgrind and test fixes
  + Various ASAN fixes

==== gstreamer-plugins-base ====
Version update (1.26.3 -> 1.26.4)
Subpackages: gstreamer-plugins-base-lang libgstallocators-1_0-0 libgstapp-1_0-0 libgstaudio-1_0-0 libgstfft-1_0-0 libgstgl-1_0-0 libgstpbutils-1_0-0 libgstriff-1_0-0 libgstrtp-1_0-0 libgstrtsp-1_0-0 libgstsdp-1_0-0 libgsttag-1_0-0 libgstvideo-1_0-0 typelib-1_0-GstAudio-1_0 typelib-1_0-GstPbutils-1_0 typelib-1_0-GstTag-1_0 typelib-1_0-GstVideo-1_0

- Update to version 1.26.4:
  + Revert "streamsynchronizer: Consider streams having received
    stream-start as waiting"
  + alsa: free conf cache under valgrind
  + gst-device-monitor: Fix caps filter splitting
  + Fix various valgrind/test errors when GST_DEBUG is enabled
  + More valgrind and test fixes
  + Various ASAN fixes

==== gstreamer-plugins-good ====
Version update (1.26.3 -> 1.26.4)
Subpackages: gstreamer-plugins-good-gtk gstreamer-plugins-good-lang

- Remove BuildRequires: libQt5PlatformHeaders-devel which isn't
  needed anymore
- Update to version 1.26.4:
  + adaptivedemux2: Fixed reverse playback
  + matroskademux: Send tags after seeking
  + qtdemux: Fix incorrect FourCC used when iterating over sbgp
    atoms
  + qtdemux: Incorrect sibling type used in sbgp iteration loop
  + rtph265pay: add profile-id, tier-flag, and level-id to output
    rtp caps
  + rtpjpeg: fix copying of quant data if it spans memory segments
  + soup: Disable range requests when talking to Python's
    http.server
  + v4l2videodec: need replace acquired_caps on set_format success
  + Fix various valgrind/test errors when GST_DEBUG is enabled
  + More valgrind and test fixes
  + Various ASAN fixes

==== gstreamer-plugins-libav ====
Version update (1.26.3 -> 1.26.4)

- Update to version 1.26.4:
  + Various ASAN fixes

==== gstreamer-plugins-ugly ====
Version update (1.26.3 -> 1.26.4)
Subpackages: gstreamer-plugins-ugly-lang

- Update to version 1.26.4:
  + No changes, stable bump only.

==== inkscape ====
Subpackages: inkscape-extensions-extra inkscape-extensions-gimp inkscape-lang

- Extension manager needs Python module 'appdirs', add dependency
  for python313-appdirs to inkscape-extensions-extra

==== kernel-source ====
Version update (6.15.7 -> 6.15.8)

- Linux 6.15.8 (bsc#1012628).
- KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop
  poll hypercalls (bsc#1012628).
- smb: client: let smbd_post_send_iter() respect the peers
  max_send_size and transmit all data (bsc#1012628).
- drm/xe: Move page fault init after topology init (bsc#1012628).
- drm/xe/mocs: Initialize MOCS index early (bsc#1012628).
- sched/ext: Prevent update_locked_rq() calls with NULL rq
  (bsc#1012628).
- sched,freezer: Remove unnecessary warning in __thaw_task
  (bsc#1012628).
- cifs: Fix reading into an ITER_FOLIOQ from the smbdirect code
  (bsc#1012628).
- cifs: Fix the smbd_response slab to allow usercopy
  (bsc#1012628).
- smb: client: make use of common smbdirect_socket_parameters
  (bsc#1012628).
- smb: smbdirect: introduce smbdirect_socket_parameters
  (bsc#1012628).
- smb: client: make use of common smbdirect_socket (bsc#1012628).
- smb: smbdirect: add smbdirect_socket.h (bsc#1012628).
- smb: smbdirect: add smbdirect.h with public structures
  (bsc#1012628).
- smb: client: make use of common smbdirect_pdu.h (bsc#1012628).
- smb: smbdirect: add smbdirect_pdu.h with protocol definitions
  (bsc#1012628).
- rust: use `#[used(compiler)]` to fix build and `modpost`
  with Rust >= 1.89.0 (bsc#1012628).
- net: libwx: fix multicast packets received count (bsc#1012628).
- usb: dwc3: qcom: Don't leave BCR asserted (bsc#1012628).
- usb: hub: Don't try to recover devices lost during warm reset
  (bsc#1012628).
- usb: hub: Fix flushing of delayed work used for post resume
  purposes (bsc#1012628).
- usb: hub: Fix flushing and scheduling of delayed work that
  tunes runtime pm (bsc#1012628).
- usb: hub: fix detection of high tier USB3 devices behind
  suspended hubs (bsc#1012628).
- sched: Change nr_uninterruptible type to unsigned long
  (bsc#1012628).
- efivarfs: Fix memory leak of efivarfs_fs_info in fs_context
  error paths (bsc#1012628).
- libbpf: Fix handling of BPF arena relocations (bsc#1012628).
- drm/mediatek: only announce AFBC if really supported
  (bsc#1012628).
- drm/mediatek: Add wait_event_timeout when disabling plane
  (bsc#1012628).
- Revert "cgroup_freezer: cgroup_freezing: Check if not frozen"
  (bsc#1012628).
- rxrpc: Fix to use conn aborts for conn-wide failures
  (bsc#1012628).
- rxrpc: Fix transmission of an abort in response to an abort
  (bsc#1012628).
- rxrpc: Fix notification vs call-release vs recvmsg
  (bsc#1012628).
- rxrpc: Fix recv-recv race of completed call (bsc#1012628).
- rxrpc: Fix irq-disabled in local_bh_enable() (bsc#1012628).
- net/sched: Return NULL when htb_lookup_leaf encounters an
  empty rbtree (bsc#1012628).
- net: bridge: Do not offload IGMP/MLD messages (bsc#1012628).
- net: vlan: fix VLAN 0 refcount imbalance of toggling filtering
  during runtime (bsc#1012628).
- tls: always refresh the queue when reading sock (bsc#1012628).
- virtio-net: fix recursived rtnl_lock() during probe()
  (bsc#1012628).
- hv_netvsc: Set VF priv_flags to IFF_NO_ADDRCONF before open
  to prevent IPv6 addrconf (bsc#1012628).
- Bluetooth: L2CAP: Fix attempting to adjust outgoing MTU
  (bsc#1012628).
- drm/xe/pf: Resend PF provisioning after GT reset (bsc#1012628).
- drm/xe/pf: Prepare to stop SR-IOV support prior GT reset
  (bsc#1012628).
- drm/xe: Dont skip TLB invalidations on VF (bsc#1012628).
- netfilter: nf_conntrack: fix crash due to removal of
  uninitialised entry (bsc#1012628).
- net: fix segmentation after TCP/UDP fraglist GRO (bsc#1012628).
- ipv6: mcast: Delay put pmc->idev in mld_del_delrec()
  (bsc#1012628).
- net: airoha: fix potential use-after-free in airoha_npu_get()
  (bsc#1012628).
- net/mlx5: Correctly set gso_size when LRO is used (bsc#1012628).
- Bluetooth: btusb: QCA: Fix downloading wrong NVM for WCN6855
  GF variant without board ID (bsc#1012628).
- Bluetooth: hci_dev: replace 'quirks' integer by 'quirk_flags'
  bitmap (bsc#1012628).
- Bluetooth: hci_core: add missing braces when using macro
  parameters (bsc#1012628).
- Bluetooth: hci_core: fix typos in macros (bsc#1012628).
- Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout
  (bsc#1012628).
- Bluetooth: SMP: If an unallowed command is received consider
  it a failure (bsc#1012628).
- Bluetooth: hci_sync: fix connectable extended advertising when
  using static random address (bsc#1012628).
- Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb()
  (bsc#1012628).
- riscv: traps_misaligned: properly sign extend value in
  misaligned load handler (bsc#1012628).
- riscv: Enable interrupt during exception handling (bsc#1012628).
    ... changelog too long, skipping 223 lines ...
- commit e03d052

==== libostree ====
Version update (2025.3 -> 2025.4)
Subpackages: libostree-1-1

- Update to version 2025.4:
  + ostree-prepare-root: remove duplicate transient directory
  + Add root.transient-ro

==== mozilla-nss ====
Version update (3.112 -> 3.113)
Subpackages: libfreebl3 libsoftokn3 mozilla-nss-certs mozilla-nss-tools

- update to NSS 3.113
  * bmo#1963792 - Fix alias for mac workers on try.
  * bmo#198090 - Part 1: Use AES in the SDR (NSS) r=simonf,nss-reviewers,rrelyea
  * bmo#1968764 - Bump nssckbi version to 2.78.
  * bmo#1967548 - Turn off Websites Trust Bit for Chunghwa Telecom ePKI Root in FF 141.
  * bmo#1965556 - fix frame pointers in intel-gcm.s.
  * bmo#1971510 - Typo in release notes for NSS 101.4.
  * bmo#1968665 - Improve nss-release-helper.py.
  * bmo#1930800 - shlibsign is broken in System FIPS mode.
  * bmo#1954612 - Need up update NSS for PKCS 3.1: Move IPSEC to 3.1
  * bmo#1965327 - PKCS #11 v3.2 header files.

==== mozjs128 ====
Version update (128.12.0 -> 128.13.0)

- Update to version 128.13.0:
  + CVE-2025-8027: JavaScript engine only wrote partial return
    value to stack
  + CVE-2025-8028: Large branch table could lead to truncated
    instruction
  + CVE-2025-8029: javascript: URLs executed on object and embed
    tags
  + CVE-2025-8030: Potential user-assisted code execution in “Copy
    as cURL” command
  + CVE-2025-8031: Incorrect URL stripping in CSP reports
  + CVE-2025-8032: XSLT documents could bypass CSP
  + CVE-2025-8033: Incorrect JavaScript state machine for
    generators
  + CVE-2025-8034: Memory safety bugs fixed in Firefox ESR 115.26,
    Firefox ESR 128.13, Thunderbird ESR 128.13, Firefox ESR 140.1,
    Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141
  + CVE-2025-8035: Memory safety bugs fixed in Firefox ESR 128.13,
    Thunderbird ESR 128.13, Firefox ESR 140.1, Thunderbird ESR
    140.1, Firefox 141 and Thunderbird 141

==== openSUSE-release ====
Version update (20250725 -> 20250727)
Subpackages: openSUSE-release-appliance-custom openSUSE-release-dvd

- automatically generated by openSUSE-release-tools/pkglistgen

==== patterns-base ====
Subpackages: patterns-base-apparmor patterns-base-base patterns-base-basesystem patterns-base-basic_desktop patterns-base-console patterns-base-enhanced_base patterns-base-minimal_base patterns-base-selinux patterns-base-sw_management patterns-base-x11 patterns-base-x11_enhanced

- Drop xsetmode and xsetpointer from x11_raspberrypi (boo#1246921)

==== patterns-gnome ====
Subpackages: patterns-gnome-gnome patterns-gnome-gnome_basic patterns-gnome-gnome_basis patterns-gnome-gnome_games patterns-gnome-gnome_imaging patterns-gnome-gnome_internet patterns-gnome-gnome_multimedia patterns-gnome-gnome_office patterns-gnome-gnome_utilities patterns-gnome-gnome_x11 patterns-gnome-gnome_yast patterns-gnome-sw_management_gnome

- Explicitly recommends Google Noto Arabic fonts in GNOME
  (bsc#1246323).

==== pixman ====

- Disable LTO on riscv64 due to gcc bug 110812

==== poppler ====
Subpackages: libpoppler-cpp2 libpoppler-glib8 libpoppler151 poppler-tools

- Do not build the qt5 flavor in SLE16.

==== poppler-qt6 ====

- Do not build the qt5 flavor in SLE16.

==== python-Babel ====

- Add reproducible.patch to normalize date in .po (boo#1047218)

==== python-kiwi ====
Version update (10.2.28 -> 10.2.29)

- Bump version: 10.2.28 → 10.2.29
- Fix return from repart stage
  If we return from the repart stage it's important to wait
  for the root device to appear. This is because the device
  setup from udev might still be held back due to a former
  lock on the device. This means if we return fast after
  locking for example when check_repart_possible() quickly
  finds out that it's not possible, then udev has not yet
  got the time to create the device nodes.
  This Fixes #2863

==== sdl2-compat ====

- Change license to Zlib

==== sysuser-tools ====

- disable the buildroot virus scanning, as it needs the vscan user
  this package provides. (bsc#1246878)

==== virtualbox ====
Version update (7.1.10 -> 7.1.12a)

- Update to release 7.1.12
  * VMM: Fixed issue when running a nested VM caused Guru
    Meditation for outer VM
  * NAT: Fixed issue when VMs with long names were unable to start
  * Linux host: Fixed possible kernel panic when using bridged
    networking with a network interface handled by the ixgbe
    driver on newer kernels
  * Recording: Fixed issue when Windows Guest Machine was unable
    to start when recording was enabled in Display Settings
  * Support for Linux 6.16
  * Linux Guest Additions (LGA): Fixed issue when 'rcvboxadd
    status-kernel' was reporting incorrect status when guest was
    running kernel 3.10 series and older
  * LGA: Fixed issue when VBoxClient was unable to start if guest
    was running kernel 2.6 series and older
  * LGA: Fixed issue which caused a warning in system log due to
    incorrect udev rule
- Delete kernel-6.16-READ-WRITE.patch, kernel-6.16-from_timer.patch,
  kernel-6.16-page-index.patch

==== virtualbox-kmp ====
Version update (7.1.10_k6.15.7_1 -> 7.1.12a_k6.15.8_1)

- Update to release 7.1.12
  * VMM: Fixed issue when running a nested VM caused Guru
    Meditation for outer VM
  * NAT: Fixed issue when VMs with long names were unable to start
  * Linux host: Fixed possible kernel panic when using bridged
    networking with a network interface handled by the ixgbe
    driver on newer kernels
  * Recording: Fixed issue when Windows Guest Machine was unable
    to start when recording was enabled in Display Settings
  * Support for Linux 6.16
  * Linux Guest Additions (LGA): Fixed issue when 'rcvboxadd
    status-kernel' was reporting incorrect status when guest was
    running kernel 3.10 series and older
  * LGA: Fixed issue when VBoxClient was unable to start if guest
    was running kernel 2.6 series and older
  * LGA: Fixed issue which caused a warning in system log due to
    incorrect udev rule
- Delete kernel-6.16-READ-WRITE.patch, kernel-6.16-from_timer.patch,
  kernel-6.16-page-index.patch