CVE-2025-55159

An extremely fast Python package and project manager, written in Rust.

Security Fix(es):

uv is a Python package and project manager written in Rust. In versions 0.8.5 and earlier, remote ZIP archives were handled in a streamwise fashion, and file entries were not reconciled against the archive's central directory. An attacker could contrive a ZIP archive that would extract with legitimate contents on some package installers, and malicious contents on others due to multiple local file entries. An attacker could also contrive a "stacked" ZIP input with multiple internal ZIPs, which would be handled differently by different package installers. The attacker could choose which installer to target in both scenarios. This issue is fixed in version 0.8.6. To work around this issue, users may choose to set UV_INSECURE_NO_ZIP_VALIDATION=1 to revert to the previous behavior.(CVE-2025-54368)

slab is a pre-allocated storage for a uniform data type. In version 0.4.10, the get_disjoint_mut method incorrectly checked if indices were within the slab's capacity instead of its length, allowing access to uninitialized memory. This could lead to undefined behavior or potential crashes. This has been fixed in slab 0.4.11. A workaround for this issue involves to avoid using get_disjoint_mut with indices that might be beyond the slab's actual length.(CVE-2025-55159)

A guided tour and greeter for GNOME.Tour uses by default the logo of the distribution based on the info from /etc/os-release. The application comes with a feature to replace the logo with a welcome video shipped by the distribution.

Security Fix(es):

slab is a pre-allocated storage for a uniform data type. In version 0.4.10, the get_disjoint_mut method incorrectly checked if indices were within the slab's capacity instead of its length, allowing access to uninitialized memory. This could lead to undefined behavior or potential crashes. This has been fixed in slab 0.4.11. A workaround for this issue involves to avoid using get_disjoint_mut with indices that might be beyond the slab's actual length.(CVE-2025-55159)

A guided tour and greeter for GNOME.Tour uses by default the logo of the distribution based on the info from /etc/os-release. The application comes with a feature to replace the logo with a welcome video shipped by the distribution.

Security Fix(es):

slab is a pre-allocated storage for a uniform data type. In version 0.4.10, the get_disjoint_mut method incorrectly checked if indices were within the slab's capacity instead of its length, allowing access to uninitialized memory. This could lead to undefined behavior or potential crashes. This has been fixed in slab 0.4.11. A workaround for this issue involves to avoid using get_disjoint_mut with indices that might be beyond the slab's actual length.(CVE-2025-55159)

A guided tour and greeter for GNOME.Tour uses by default the logo of the distribution based on the info from /etc/os-release. The application comes with a feature to replace the logo with a welcome video shipped by the distribution.

Security Fix(es):

slab is a pre-allocated storage for a uniform data type. In version 0.4.10, the get_disjoint_mut method incorrectly checked if indices were within the slab's capacity instead of its length, allowing access to uninitialized memory. This could lead to undefined behavior or potential crashes. This has been fixed in slab 0.4.11. A workaround for this issue involves to avoid using get_disjoint_mut with indices that might be beyond the slab's actual length.(CVE-2025-55159)

A guided tour and greeter for GNOME.Tour uses by default the logo of the distribution based on the info from /etc/os-release. The application comes with a feature to replace the logo with a welcome video shipped by the distribution.

Security Fix(es):

slab is a pre-allocated storage for a uniform data type. In version 0.4.10, the get_disjoint_mut method incorrectly checked if indices were within the slab's capacity instead of its length, allowing access to uninitialized memory. This could lead to undefined behavior or potential crashes. This has been fixed in slab 0.4.11. A workaround for this issue involves to avoid using get_disjoint_mut with indices that might be beyond the slab's actual length.(CVE-2025-55159)

slab is a pre-allocated storage for a uniform data type. In version 0.4.10, the get_disjoint_mut method incorrectly checked if indices were within the slab's capacity instead of its length, allowing access to uninitialized memory. This could lead to undefined behavior or potential crashes. This has been fixed in slab 0.4.11. A workaround for this issue involves to avoid using get_disjoint_mut with indices that might be beyond the slab's actual length.

slab is a pre-allocated storage for a uniform data type. In version 0.4.10, the get_disjoint_mut method incorrectly checked if indices were within the slab's capacity instead of its length, allowing access to uninitialized memory. This could lead to undefined behavior or potential crashes. This has been fixed in slab 0.4.11. A workaround for this issue involves to avoid using get_disjoint_mut with indices that might be beyond the slab's actual length.

These are all security issues fixed in the framework_tool-0.4.5-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the gstreamer-devtools-1.26.5-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the gstreamer-plugins-rs-1.26.5+git11.949807a4-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the aws-efs-utils-2.3.3-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the wicked2nm-1.2.1-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the flake-pilot-3.1.21-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the keylime-ima-policy-0.2.8+12-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the fractal-12.0-3.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the scx-1.0.15-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the watchexec-2.3.2-2.1 package on the GA media of openSUSE Tumbleweed.

This update for flake-pilot fixes the following issues:

Update version to 3.1.22.

• Fixes to use flakes as normal user

  Running a flake is a container based instance provisioning and startup. Some part of this process requires root permissions for example mounting the container instance store for the provisioning step. This commit fixes the required calls to be properly managed by sudo.

• seed from entropy

• Fix assignment of random sequence number

  We should use a seed for the sequence as described in https://rust-random.github.io/book/guide-seeding.html#a-simple-number In addition the logic when a random sequence number should be used was wrong and needed a fix regarding resume and attach type flakes which must not use a random sequence

• Pass --init option for resume type flakes

  In resume mode a sleep command is used to keep the container open. However, without the --init option there is no signal handling available. This commit fixes it

• Revert "kill prior remove when using %remove flag"

  This reverts commit 06c7d4aa71f74865dfecba399fd08cc2fde2e1f2. no hard killing needed with the event loop entrypoint

• Fixed CVE-2025-55159 slab: incorrect bounds check

  Update to slab 0.4.11 to fix the mentioned CVE. This Fixes bsc#1248004

• Apply clippy fixes

• Create sequence number for the same invocation

  If a flake which is not a resume or attach flake is called twice with the same invocation arguments an error message is displayed to give this invocation a new name via the @NAME runtime option. This commit makes this more comfortable and automatically assigns a random sequence number for the call if no @NAME is given.

• kill prior remove when using %remove flag

  In case the container instance should be removed via the %remove flag, send a kill first, followed by a force remove. The reason for this is because we use a never ending sleep command as entry point for resume type containers. If they should be removed the standard signal send on podman rm will not stop the sleep and after a period of 10 seconds podman sends a kill signal itself. We can speedup this process as we know the entry point command and send the kill signal first followed by the remove which saves us some wait time spent in podman otherwise.

• Fix clippy hints

  variables can be used directly in the format! string

• Prune old images after load

  Make sure no <none> image references stay in the registry

These are all security issues fixed in the git-cliff-2.12.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the afterburn-5.10.0.git73.b97f772-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the kak-lsp-21.0.2-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the ab-av1-0.11.7-1.1 package on the GA media of openSUSE Tumbleweed.

This update for gstreamer-rtsp-server, gstreamer-plugins-ugly, gstreamer-plugins-rs, gstreamer-plugins-libav, gstreamer-plugins-good, gstreamer-plugins-base, gstreamer-plugins-bad, gstreamer-docs, gstreamer-devtools, gstreamer fixes the following issues:

Changes in gstreamer-rtsp-server:

• Update to version 1.26.7:
  • Fix issues with G_DISABLE_CHECKS & G_DISABLE_ASSERT.
  • rtsp-server: tests: Switch to fixtures to ensure pool shutdown
  • rtsp-server: tests: Fix a few memory leaks

Changes in gstreamer-plugins-ugly:

• Update to version 1.26.7:
  • No changes, stable version bump only.

Changes in gstreamer-plugins-rs:

• Update to version 1.26.7+git0.6ab75814:

  • tracers: Fix inverted append logic when writing log files

  • threadshare:

    • examples: standalone: also handle buffer lists
    • Pad push_list: downgrade Pad flushing log level
    • sinks: fix / handle query()
    • backpressure: abort pending items on flush start
    • udpsink: fix panic recalculating latency from certain executors
    • audiotestsrc: . support more Audio formats . use AudioInfo . fix latency . act as a pseudo live source by default
    • runtime task: execute action in downward transition
    • example cleanups
    • udpsink: distinguish sync status for latency & report added latency
    • sink elements: implement send_event
    • dataqueue elements: report min and max latency

  • rtp:

    • Add linear audio (L8, L16, L24) RTP payloaders / depayloaders

  • rtp: basedepay: reuse last PTS, when possible

  • skia: Update to skia-safe 0.89

  • mp4: Update to mp4-atom 0.9

  • Update dependencies

  • webrtc: livekit: Drop connection lock after take()

  • onvifmetadatapay: copy metadata from source buffer

  • fallbacksrc: Fix custom source reuse case

  • add rust-tls-native-roots feature to the reqwest dep

  • rtpamrpay2:

    • Actually forward the frame quality indicator
    • Set frame quality indicator flag

• Add patch to fix reproducibility of package build (boo#1237097)

• Update to version 1.26.6+git20.e287e869:

  • Fix some new clippy 1.90 warnings
  • colordetect: Don't use deprecated color_name API
  • deny: Update
  • quinn: Update to web-transport-quinn 0.8
  • skia: Update to skia-safe 0.88
  • Update Cargo.lock
  • Allow windows-sys 0.61 too
  • intersink: add sync property
  • meson: Fix .pc files installation and simplify build output handling. This also fixes the .pc file install directory and ensures that the .pc files are only installed when static builds is enabled.

• Drop devel subpackage following upstream changes.

• Update to version 1.26.6:

  • aws: Ensure task stopping on paused-to-ready state change

  • fallbacksrc:

    • Don't panic during retries if the element was shut down in parallel
    • Don't restart source if the element is just being shut down
    • Fix some custom source deadlocks
    • Fix sources only being restarted once

  • gtk4: Try importing dmabufs withouth DMA_DRM caps

  • inter: Give the appsrc/appsink a name that has the parent element as prefix

  • mp4: Skip tests using x264enc if it does not exist

  • rtpgccbwe: avoid clamp() panic when min_bitrate > max_bitrate

  • rtpmp4gdepay2: allow only constantduration with neither constantsize nor sizelength set

  • rtprecv: fix race condition on first buffer

  • speechmatics: Specify rustls as an explicit dependency

  • spotify: update to librespot 0.7

  • threadshare:

    • add a blocking adapter element
    • always use block_on_or_add_subtask
    • audiotestsrc: fix setting samples-per-buffer...
    • blocking_adapter: fix Since marker in docs
    • fix resources not available when preparing asynchronously
    • fix ts-inter test one_to_one_up_first
    • have: have Task log its obj
    • intersink: return from blocking tasks when stopping
    • inter: update doc example
    • runtime/pad: lower log level pushing Buffer to flushing pad
    • separate blocking & throttling…

This update for rust-keylime fixes the following issues:

• Update to version 0.2.8+116:
• CVE-2026-25727: Update vendored crates to fix a date parser can lead to stack exhaustion in Time. (bsc#1257908)

This update for glycin-loaders fixes the following issues

• CVE-2025-55159: slab: incorrect bounds check in get_disjoint_mut function can lead to undefined behavior or potential crash due to out-of-bounds access (bsc#1248035).
• CVE-2025-58160: tracing-subscriber: Tracing log pollution (bsc#1249010).

This update for kak-lsp fixes the following issues:

Changes in kak-lsp:

• Update to version 21.0.2:

  • Fix a regression that broke compatibility with Kakoune versions older than 2026.05.21
  • Add a default configuration for Hare, using hare-lsp
  • Fix hangs after editing a file without a trailing newline, such as an empty file
  • Use nixd instead of nil as the default language server for nix
  • Fix buffer-sync corruption when .editorconfig sets insert_final_newline = false

• Refresh the vendored registry. Recording the state of the open vendored-crate CVEs against it, none of which this package is affected by:

  • CVE-2026-25541 (boo#1274502): bytes is 1.12.1, above the 1.11.1 fix
  • CVE-2025-3416 (boo#1242654): the openssl crate is 0.10.81, above the 0.10.72 fix; it was already 0.10.80 before this update
  • CVE-2025-55159 (boo#1248048): slab is 0.4.12, above the 0.4.11 fix; only 0.4.10 was ever affected and this package never shipped it

• Update to version 20.0.0:

  • v20.0.0
  • Update changelog
  • Fix tinymist documentation URL
  • Fix tinymist preview config key. previewFeature only works for the vscode plugin
  • Encode brackets for file paths
  • feat: swift/sourcekit-lsp support
  • Paal �ye-Str�mme Copyright Waiver
  • Make sure buffer synchronization works even when finaleol is missing
  • workspace/executeCommand: don't panic on invalid args JSON
  • servers.kak: update markdown-oxide root markers
  • Inline lsp-initial-goto-position
  • Fix function_casts_as_integer warning
  • lsp-capabilities: remove stale default mappings
  • changelog new erlang default server
  • fix(ci/commit-new-release.sh): interpolate version number
  • Change default language server for erlang
  • lsp-inlay-hint-apply-*: fix crash when no hints avail
  • Add inlay hint textedit support
  • start new cycle

• Update to version 19.0.1:

  • v19.0.1
  • Don't print Hover: prefix if there are no diagnostics
  • Changelog for regression fix
  • Fix lsp-find-error incorrectly handling --previous flag
  • ci/commit-new-release.sh: support jj
  • start new cycle

• Update to version 18.2.0:

  • v18.2.0
  • Update changelog
  • Remove misleading debug log in SessionRenamed hook
  • Make diagnostics buffer one-line-per diagnostics
  • test/gopls-dynamic-settings.sh: fix for recent gopls
  • clippy
  • controller: consume entire request before checking for user errors
  • Add support vuejs
  • Fix crash on invalid text edit ranges
  • Send initializationOptions and workspace/didChangeConfiguration as expected by jdtls
  • cargo update
  • Fix type inference errors with deranged 0.4.1
  • Fix symbol name prefix for breadcrumbs
  • Work around breaking change in deranged crate
  • Simplify recursive breadcrumbs calculation
  • Language-specific SymbolKind rendering
  • lsp-goto-document-symbol: remove symbol kind suffix
  • start new cycle

• Update to version 18.1.3:

  • v18.1.3
  • Use the right language ID when [language.foo] is in effect
  • Remove unused line-specs option
  • Better variable name for code lens line-specs value
  • lsp-object: don't send documentSymbol to servers that don't support it
  • Include language server name in stderr logs
  • Use rust-analyzer from PATH
  • Work around lsp-rename didChange failing when using window scope
  • Send texlab-specific requests only to servers that support them
  • Fix dart language server command
  • Add kak-lsp server PID to the closing log message
  • Report more diagnostics information, in multiple lines
  • Fix regression causing spurious/missing server name in hover
  • Address clippy lints
  • Config knob to override magic single-instance setting
  • Back out "Add curly underline to DiagnosticError face"
  • start new cycle

• Update to version 18.1.2:

  • Silence errors from non-default hooks
  • Fix languageId for JSX/TSX files
  • Silence deprecation warning
  • Add curly underline to DiagnosticError face

• Update to version 18.1.1: …

This update for git-cliff fixes the following issues:

Changes in git-cliff:

• Update to version 2.13.1:

  • Support more configuration file locations
  • Add per-commit statistics
  • Expose determined bump type in release context
  • Add configurable commit processing order
  • Add environment variable for offline execution
  • Migrate logging to tracing
  • Add caching where applicable

• CVE-2026-25541: bytes: integer overflow in 'BytesMut:reserve' can lead to undefined behavior and crashes (boo#1274523)

• Update to version 2.12.0:

  • Add offline flag
  • Add --skip-tags cli argument
  • Implement commit processing summary
  • Bug Fixes

• includes changes from 2.11.0:

  • Support failing on unmatched commits
  • Add support for azure devops
  • Improve repository/directory path resolution
  • Add split_regex, replace_regex, find_regex filters
  • Bug Fixes

• includes changes from 2.10.1:

  • Add 'integrations' feature flag for enabling all integrations
  • Bug Fixes
  • CVE-2025-55159: lab: incorrect bounds check in get_disjoint_mut function can lead to undefined behavior or potential crash due to out-of-bounds access (boo#1248065)

• Update to version 2.10.0:

  • (config) Support using include and exclude paths in the config (#1173) - (7c2f922)
  • (parser) Support regex matching on JSON arrays with scalar elements (#1163) - (dc458ea)
  • (template) Support adding commit statistics to the changelog (#1151) - (05a50d7)
  • (config) [breaking] Use empty header and footer as default (#1161) (#1172) - (3e9311e)
  • (config) Check if commit.footers is defined in detailed example (#1170) - (078545f)
  • (fixtures) Update expected.md after config change (#1176) - (76d3e81)
  • (generation) Ensure skip_tags condition is evaluated first (#1190) - (318be66)
  • (repo) Use the correct order while diffing paths (#1188) - (ff6c310)
  • (ci) Apply security best practices (#1180) - (a32deca)
  • (config) Implement FromStr instead of Config::parse_from_str() (#1185) - (692345e)
  • (test) Standardize unit tests for commit module (#1147) - (0446d6a)
  • (context) Add example usage for statistics (#1162) - (4f7379a)
  • (quickstart) Remove repetitive words (#1200) - (434f9ee)
  • (readme) Fix twitter badge (#1164) - (68bd85e)
  • (readme) Polish badges (#1159) - (941cc2b)
  • (remote) Fix inconsistency in remote integration documentation (#1165) - (deb29dc)
  • (website) Add highlights for 2.10.0 (#1225) - (a3fe8c9)
  • (website) Add installation instructions for gentoo-linux (#1203) - (07fe6bf)
  • (formatting) Use spaces instead of tabs (#1184) - (0027300)
  • (fixture) Add test fixture for overriding the conventional scope (#1166) - (cb84a08)
  • (build) Bump MSRV to 1.85.1 - (d8279d4)
  • (cd) Use macos-15 runner - (c156fc5)
  • (cd) Re-enable sccache for maturin - (871c3c9)
  • (crate) Remove Rust nightly requirement - (4f3e5af)
  • (fixture) Update test-regex-json-array fixture (#1178) - (95f4056)
  • (format) Format module imports for readability (#1183) - (6db7d49)
  • (git) Add .git-blame-ignore-revs - (5b64131)
  • (npm) Bump git-cliff to 2.9.1 (#1156) - (e13b158)
  • (website) Update the node version - (566c2a1)
  • Check if commit.footers is defined in detailed example (#1170) (078545f)
  • (breaking) Use empty header and footer as default (#1161) (#1172) (3e9311e)
  • Update expected.md after config change (#1176) (76d3e81)
  • Use the correct order while diffing paths (#1188) (ff6c310)
  • Ensure skip_tags condition is evaluated first (#1190) (318be66)
  • Polish badges (#1159) (941cc2b)
  • Fix twitter badge (#1164) (68bd85e)
  • Fix inconsistency in remote integration documentation (#1165) (deb29dc)
  • Add example usage for statistics (#1162) (4f7379a)
  • Remove repetitive words (#1200) (434f9ee)
  • Add installation instructions for gentoo-linux (#1203) (07fe6bf)
  • Add highlights for 2.10.0 (#1225) (a3fe8c9)
  • Support regex matching on JSON arrays with scalar elements (#1163) (dc458ea)
  • Support using…

This update for forgejo-cli fixes the following issues:

Changes in forgejo-cli:

• Update vendored bytes crate to 1.12.1

  • CVE-2026-25541: Fixed an integer overflow in BytesMut::reserve that could corrupt the tracked capacity and lead to out-of-bounds slices (boo#1274529).

• update to 0.6.0:

  • Localization!
    • forgejo-cli has gained localization support! You can now use it in your preferred language, just like Forgejo itself. Currently de-DE and zh-Hans are included, with several more being in-progress. See the project on Codeberg Translate if you want to help out with any languages you know! https://translate.codeberg.org/projects/forgejo-cli/forgejo-cli/
  • Additions
    • (!586) fj issue/pr view assignees to see who is assigned to an issue or pull request
    • (!582) --avatar/--unset-avatar options on fj repo edit
    • (!554) fj repo star-status to check if you've starred a repo
    • (!547) --cwd option to set the working directory a command is run in
    • (!533, !561) Commands to watch and unwatch repos
    • (!462) Resolve SSH host names from SSH config
    • (!279, !464, !472, !489, !491, !513, !594) Localization
    • Added fj auth login support for the following instances:
      • v16.next.forgejo.org
      • v17.next.forgejo.org
    • Removed fj auth login support for the following instances that have shut down:
      • v7.next.forgejo.org
      • v12.next.forgejo.org
  • Changes
    • (!535) Added an error message when fj auth login fails to open the browser
    • (!523) fj auth add-key was renamed to fj auth add-token. An alias still exists to add-key, so this isn't a breaking change.
    • (!514) The --host flag can now be anywhere in the command, instead of only the beginning
    • (!504) fj auth add-token no longer takes a username argument.
  • Fixes
    • (!579) Fixed fj issue unassign incorrectly unassigning everyone except the intended users
    • (!569) Fixed display of labels failing when a label is marked as exclusive but does not contain a slash
    • (!542) Fixed parsing of SSH shorthand urls
    • (!510) Fixed fj pr checkout failing when the instance URL contained a port
    • (!437) Fixed incorrect parsing of activity info
  • Other
    • (!573) Use rust 2024 edition
    • (!560) Simplify determining repo owner
    • (!531) Fix clippy warnings
    • (!527) Remove unused dependencies, narrow tokio features
    • (!526) Replace crossterm with terminal_size
    • (!520) Optimize cargo release profile
    • (!469) Fix typo
    • (!449) Restricted file permissions at creation time
    • (!443) Add oneline helptext to 'repo migrate' command

• update to 0.5.0:

  • Additions
    • (!334) Support for managing labels on issues and repos.
    • (!349) repo edit and repo units for modifying settings on a repo and repo units.
    • (!373) Use the needed CLI flags for more editors when opening them.
    • (!385) Use the editor defined in git's core.editor config option by default (falling back to $EDITOR if it is not set).
    • (!414) Add commands to assign and unassign users to issues and PRs.
    • (!415) Support all README files in fj repo readme, regardless of case or extension.
    • (!416) Add the option to choose what repo to own the new repo to fj repo migrate.
    • (!419) Show a warning when viewing an archived repo.
    • (!420) Add a notice about git push --force not being supported on AGit PRs.
    • Added fj auth login support for the following instances:
      • v15.next.forgejo.org
      • codefloe.com
  • Fixes
    • (!393) Don't include pull requests in fj issues search.
    • (!407) Guarantee opening the browser in fj auth login doesn't block.
    • (!417) Prevent incorrectly reusing the refresh token when refreshing OAuth tokens.
  • Other
    • (!278) Improved "no repo info" error message.
    • (!403) Build aarch64…

Impact

The get_disjoint_mut method in slab v0.4.10 incorrectly checked if indices were within the slab's capacity instead of its length, allowing access to uninitialized memory. This could lead to undefined behavior or potential crashes.

Patches

This has been fixed in slab v0.4.11.

Workarounds

Avoid using get_disjoint_mut with indices that might be beyond the slab's actual length, or upgrade to v0.4.11 or later.

References

• https://github.com/tokio-rs/slab/pull/152

This update for suse-migration-sle16-activation, SLES16-Migration, SLES16-SAP_Migration, suse-migration-services, suse-migration-rpm, wicked2nm, image-janitor fixes the following issues:

Changes for suse-migration-sle16-activation:

• Simplify interface naming by disabling predictable names at boot
• shellcheck heavily complained
• check migration target before testing for architecture version
• Create systemd.link files for virtual VMware/Hyper-V NICs
• Add changes for newest wicked2nm
• Activation packages can no longer be noarch
• Architecture check before allowing migration to be activated
• Add missing pre snapshot setup to run_migration
• Add wicked2nm network migration
• Setup ExclusiveArch for activation packages
• Make activation package require by provides tag
• Fix product related requirement settings

Changes for SLES16-Migration:

• Added .ssh directory for migration user
• Add etc/motd overlay file Print message how to show migration progress information
• Fix build on more architectures
• Initial changelog

Changes for SLES16-SAP_Migration:

• Support wicked2nm migration
• Migration live image for SLES4SAP 15 to 16

Changes for suse-migration-services:

• Set systemd offline for Zypper in chroot mode
• Fix apparmor install procedure
• Fixed azuremetadata device lookup
• Use of f-strings not allowed in the DMS
• Simplify interface naming by disabling predictable names at boot
• Fixed test_check_lsm_migration unit test
• Fix setup_host_network_test by mocking os.makedirs
• wicked2nm: log network state on nm-online failure
• Fixed LSM pre checks to be more robust
• shellcheck heavily complained
• Do not evaluate wicked2nm output in precheck
• Fix unit test for lsm check
• prechecks/lsm.py: remove _apparmor_analyze_profiles()
• LSM migration check for AppArmor -> SELinux
• Improve pre-check message
• Fix MinSLEVersion value depending on target
• reduce package set on migration image
• Fixed behavior of wicked2m pre check
• implementation of sshd root login pre-check
• Fixed selinux to apparmor migration
• Fixed reading of migration config for target class
• Add recursion guard to MigrationConfig::_merge_config_dicts
• shrink migration image
• container/sle16/config.sh
• sle16/config.sh - use dropin for s390 migration-config
• doc: fix indentation
• check for migration target by matching ISO file name
• config: introduce dropin dir migration-config.d/
• Apply SLE16 live image setup to container setup
• bind mount only required subdirectories under /run into chroot
• Add missing package requirement
• check migration target before testing for architecture version
• setup_host_network: simplify code - use os.makedirs()
• Create systemd.link files for virtual VMware/Hyper-V NIC
• Preserve systemd.link files from /etc/systemd/network/
• Add changes for the newest wicked2nm
• Ensure wicked2nm is a dependency of pre-checks for SLE 16 migration
• Activation packages can no longer be noarch
• Fix update of image .changes files
• Architecture check before allowing migration to be activated
• Improve error logs when wicked2nm fails
• Include image changelog to version bump
• Ensure wicked2nm migration is always running, despite warnings
• Fix: add --no-recommends on patterns-base-selinux installation
• Update suse-migration-services for container use
• Update SLE16 migration container
• Update SAP live migration image
• Add missing pre snapshot setup to run_migration
• Follow up fix for the wicked to nm migration
• Add wicked2nm network migration
• Add glob support to preserve_files
• Setup ExclusiveArch for activation packages
• Build sles4sap migration for cloud on x86_64 only
• Do not build sles4sap migration on s390x
• Use systemctl kexec
• Fix: return the correct kernel path based on machine type
• Fixed glob pattern match for package name
• Remove menitoning of SLES 12-SP4
• Make activation package require by provides tag
• Added SLES16-SAP_Migration live image
• Do not use list[str] type hint
• Fix error…

This update for rust-keylime fixes the following issues:

• Update slab to version 0.4.11:

  • CVE-2025-55159: Fixed incorrect bounds check in get_disjoint_mut function (bsc#1248006)

• Update to version 0.2.8+12:

  • build(deps): bump actions/checkout from 4 to 5
  • build(deps): bump cfg-if from 1.0.0 to 1.0.1
  • build(deps): bump openssl from 0.10.72 to 0.10.73
  • build(deps): bump clap from 4.5.39 to 4.5.45
  • build(deps): bump pest from 2.8.0 to 2.8.1
  • Fix clippy warnings
  • Use verifier-provided interval for continuous attestation timing
  • Add meta object with seconds_to_next_attestation to evidence response
  • Fix boot time retrieval
  • Fix IMA log format (it must be ['text/plain']) (#1073)
  • Remove unnecessary configuration fields
  • cargo: Bump retry-policies to version 0.4.0

This update for rust-keylime fixes the following issues:

• Update slab to version 0.4.11:

  • CVE-2025-55159: Fixed incorrect bounds check in get_disjoint_mut function (bsc#1248006)

• Update to version 0.2.8+12:

  • build(deps): bump actions/checkout from 4 to 5
  • build(deps): bump cfg-if from 1.0.0 to 1.0.1
  • build(deps): bump openssl from 0.10.72 to 0.10.73
  • build(deps): bump clap from 4.5.39 to 4.5.45
  • build(deps): bump pest from 2.8.0 to 2.8.1
  • Fix clippy warnings
  • Use verifier-provided interval for continuous attestation timing
  • Add meta object with seconds_to_next_attestation to evidence response
  • Fix boot time retrieval
  • Fix IMA log format (it must be ['text/plain']) (#1073)
  • Remove unnecessary configuration fields
  • cargo: Bump retry-policies to version 0.4.0

This update for rust-keylime fixes the following issues:

• Update slab to version 0.4.11:

  • CVE-2025-55159: Fixed incorrect bounds check in get_disjoint_mut function (bsc#1248006)

• Update to version 0.2.8+12:

  • build(deps): bump actions/checkout from 4 to 5
  • build(deps): bump cfg-if from 1.0.0 to 1.0.1
  • build(deps): bump openssl from 0.10.72 to 0.10.73
  • build(deps): bump clap from 4.5.39 to 4.5.45
  • build(deps): bump pest from 2.8.0 to 2.8.1
  • Fix clippy warnings
  • Use verifier-provided interval for continuous attestation timing
  • Add meta object with seconds_to_next_attestation to evidence response
  • Fix boot time retrieval
  • Fix IMA log format (it must be ['text/plain']) (#1073)
  • Remove unnecessary configuration fields
  • cargo: Bump retry-policies to version 0.4.0

This update for rust-keylime fixes the following issues:

• Update vendored crate slab to version 0.4.11

  • CVE-2025-55159: Fixed incorrect bounds check in get_disjoint_mut function leading to undefined behavior or potential crash due to out-of-bounds access (bsc#1248006)

• Update to version 0.2.8+12:

  • build(deps): bump actions/checkout from 4 to 5
  • build(deps): bump cfg-if from 1.0.0 to 1.0.1
  • build(deps): bump openssl from 0.10.72 to 0.10.73
  • build(deps): bump clap from 4.5.39 to 4.5.45
  • build(deps): bump pest from 2.8.0 to 2.8.1
  • Fix clippy warnings
  • Use verifier-provided interval for continuous attestation timing
  • Add meta object with seconds_to_next_attestation to evidence response
  • Fix boot time retrieval
  • Fix IMA log format (it must be ['text/plain']) (#1073)
  • Remove unnecessary configuration fields
  • cargo: Bump retry-policies to version 0.4.0

• Update vendored crate shlex to version 1.3.0

  • CVE-2024-58266: Fixed command injection (bsc#1247193)

• Update to version 0.2.7+141:

  • service: Use WantedBy=multi-user.target
  • rpm: Add subpackage for push-attestation agent
  • push-model: implement continuous attestation with configurable intervals
  • Retry registration forever in the state machine
  • Add Verifier URL to configuration
  • Align exp.backoff to current configuration format
  • Increase coverage of state machine (using Context)
  • Increase coverage of struct_filler.rs
  • Groom code (remove dead code)
  • Fix exponential backoff (10secs, 4xx accepted)
  • test: Add documentation test to tests/run.sh
  • tpm: Avoid running code example during documentation tests
  • state_machine: Always start the agent from the Unregistered state
  • Add fixes for the URL construction
  • Refactor evidences collection in push attestation agent
  • push-model: refactor attestation logic into a state machine
  • Fix body sending by allowing serializing strings (#1057)
  • Log ResilientClient errors/response status codes (#1055)
  • Add AK signing scheme and hash algorithm to negotiation
  • tpm: Add method to extract signing scheme and hash algorithm from AK
  • Allow custom content-type/accept headers
  • Integrate exponential backoff to registration (#1052)
  • keylime/structures: Rename ShaValues to PcrBanks
  • Add resilient_client for exponential backoff (#1048)

• Update vendored crate openssl 0.10.73:

  • CVE-2025-3416: Fixed Use-After-Free in Md::fetch and Cipher::fetch (bsc#1242623)

• Update to version 0.2.7+117:

  • Increase coverage in evidence handling structure
  • Add Capabilities Negotiations resp. missing fields
  • Fix UEFI test to check file access in all cases
  • context_info_handler: Do not assume /var/lib/keylime exists
  • Fix clippy warnings about uninlined format arguments
  • attestation: Allow unwrap() in tests
  • Increase coverage (groom code, extend unit tests)
  • Include IMA/UEFI logs in Evidence Handling request
  • Include method to get all IMA entries as string
  • Send correct list of pcr banks and sign algorithms
  • Try to fix TPM tests related issues
  • Define attestation perform asynchronous
  • Perform attestation in push model agent binary
  • Refactor code to use new attestation.rs
  • Create attestation.rs for Attestation stuff
  • Move ContextInfo management to its own handler
  • Adjust context_info.rs after rebase
  • Add attestation function to ContextInfo structure
  • Add prohibited signing algorithms, avoid ecschnorr
  • keylime/config: Use macro to implement PushModelConfigTrait
  • Introduce keylime-macros and define_view_trait
  • config: Remove KeylimeConfig structure
  • config: Remove unnecessary options and lazy initialization
  • Fix pcr_bank function to send all possible slots
  • Send Content-Type:application/json on request (#1039)
  • Send correct 'key_algorithm' in certification_keys (#1035)
  • Push Model: Persist Attestation Key to file
  • Add Keylime push model binary to root GNUmakefile
  • Use…

This update for rust-keylime fixes the following issues:

• CVE-2025-55159: slab: incorrect bounds check in get_disjoint_mut function can lead to undefined behavior or potential crash due to out-of-bounds access (bsc#1248006)

• CVE-2025-3416: openssl: Use-After-Free in Md::fetch and Cipher::fetch in rust-openssl crate (bsc#1242623)

• CVE-2024-58266: shlex: certain bytes allowed to appear unquoted and unescaped in command arguments (bsc#1247193)

• CVE-2024-43806: rustix: rustix::fs::Dir iterator with the linux_raw backend can cause memory explosion (bsc#1229952)

• CVE-2024-12224: idna: idna accepts Punycode labels that do not produce any non-ASCII when decoded (bsc#1243861)

• RUSTSEC-2024-0006: Multiple issues involving quote API (bsc#1230029)

This update for flake-pilot fixes the following issues:

Update version to 3.1.22.

• Fixes to use flakes as normal user

  Running a flake is a container based instance provisioning and startup. Some part of this process requires root permissions for example mounting the container instance store for the provisioning step. This commit fixes the required calls to be properly managed by sudo.

• seed from entropy

• Fix assignment of random sequence number

  We should use a seed for the sequence as described in https://rust-random.github.io/book/guide-seeding.html#a-simple-number In addition the logic when a random sequence number should be used was wrong and needed a fix regarding resume and attach type flakes which must not use a random sequence

• Pass --init option for resume type flakes

  In resume mode a sleep command is used to keep the container open. However, without the --init option there is no signal handling available. This commit fixes it

• Revert "kill prior remove when using %remove flag"

  This reverts commit 06c7d4aa71f74865dfecba399fd08cc2fde2e1f2. no hard killing needed with the event loop entrypoint

• Fixed CVE-2025-55159 slab: incorrect bounds check

  Update to slab 0.4.11 to fix the mentioned CVE. This Fixes bsc#1248004

• Apply clippy fixes

• Create sequence number for the same invocation

  If a flake which is not a resume or attach flake is called twice with the same invocation arguments an error message is displayed to give this invocation a new name via the @NAME runtime option. This commit makes this more comfortable and automatically assigns a random sequence number for the call if no @NAME is given.

• kill prior remove when using %remove flag

  In case the container instance should be removed via the %remove flag, send a kill first, followed by a force remove. The reason for this is because we use a never ending sleep command as entry point for resume type containers. If they should be removed the standard signal send on podman rm will not stop the sleep and after a period of 10 seconds podman sends a kill signal itself. We can speedup this process as we know the entry point command and send the kill signal first followed by the remove which saves us some wait time spent in podman otherwise.

• Fix clippy hints

  variables can be used directly in the format! string

• Prune old images after load

  Make sure no <none> image references stay in the registry

This update for sccache fixes the following issues:

• CVE-2025-55159 - updated slab with the uninit memory access fix (bsc#1248003)

This update for aws-efs-utils fixes the following issues:

Update to version 2.3.3 (bsc#1240044).

Security issues fixed:

• CVE-2025-55159: slab: incorrect bounds check in get_disjoint_mut function can lead to potential crash due to out-of-bounds access (bsc#1248055).
• CVE-2020-35881: traitobject: log4rs: out-of-bounds write due to fat pointer layout assumptions (bsc#1249851).

Other issues fixed:

• Build and install efs-proxy binary (bsc#1240044).

• Fixed in version 2.3.3:

  • Add environment variable support for AWS profiles and regions
  • Regenerate Cargo.lock with rust 1.70.0
  • Update circle-ci config
  • Fix AWS Env Variable Test and Code Style Issue
  • Remove CentOS 8 and Ubuntu 16.04 from verified Linux distribution list

• Fixed in version 2.3.2:

  • Update version in amazon-efs-utils.spec to 2.3.1
  • Fix incorrect package version

• Fixed in version 2.3.1:

  • Fix backtrace version to resolve ubuntu and rhel build issues
  • Pin Cargo.lock to avoid unexpected error across images

• Fixed in version 2.3.0:

  • Add support for pod-identity credentials in the credentials chain
  • Enable mounting with IPv6 when using with the 'stunnel' mount option

• Fixed in version 2.2.1:

  • Update log4rs

• Fixed in version 2.2.0

  • Use region-specific domain suffixes for dns endpoints where missing
  • Merge PR #211 - Amend Debian control to use binary architecture

• Fixed in version 2.1.0

  • Add mount option for specifying region
  • Add new ISO regions to config file

• Fixed in version 2.0.4

  • Add retry logic to and increase timeout for EC2 metadata token retrieval requests

• Fixed in version 2.0.3:

  • Upgrade py version
  • Replace deprecated usage of datetime

• Fixed in version 2.0.2

  • Check for efs-proxy PIDs when cleaning tunnel state files
  • Add PID to log entries

• Fxied in version 2.0.1

  • Disable Nagle's algorithm for efs-proxy TLS mounts to improve latencies

• Fixed in version 2.0.0:

  • Replace stunnel, which provides TLS encryptions for mounts, with efs-proxy, a component built in-house at AWS. Efs-proxy lays the foundation for upcoming feature launches at EFS.

• Fixed in version 1.36.0:

  • Support new mount option: crossaccount, conduct cross account mounts via ip address. Use client AZ-ID to choose mount target.

• Fixed in version 1.35.2:

  • Revert 'Add warning if using older Version'
  • Support MacOS Sonoma

• Fixed in version 1.35.1:

  • Revert openssl requirement change
  • Revert 'Update EFS Documentation: Clarify Current FIPS Compliance Status'
  • Update EFS Documentation: Clarify Current FIPS Compliance Status
  • test: Change repo urls in eol debian9 build
  • Check private key file size to skip generation
  • test: Fix pytest that failed since commit 3dd89ca
  • Fix should_check_efs_utils_version scope
  • Add warning if using old version
  • Add 'fsap' option as EFS-only option

• Fixed in version 1.35.0:

  • Add parameters to allow mount fo pod impersonation feature in EFS CSI Driver
  • Updated the README with support of Oracle8 distribution
  • Readme troubleshooting section + table of contents
  • Add efs-utils Support for MacOS Ventura EC2 instances

This update for sccache fixes the following issues:

• CVE-2025-55159: updated slab with the uninit memory access fix (bsc#1248003)

This update for gstreamer-rtsp-server, gstreamer-plugins-ugly, gstreamer-plugins-rs, gstreamer-plugins-libav, gstreamer-plugins-good, gstreamer-plugins-base, gstreamer-plugins-bad, gstreamer-docs, gstreamer-devtools, gstreamer fixes the following issues:

Changes in gstreamer-rtsp-server:

• Update to version 1.26.7:
  • Fix issues with G_DISABLE_CHECKS & G_DISABLE_ASSERT.
  • rtsp-server: tests: Switch to fixtures to ensure pool shutdown
  • rtsp-server: tests: Fix a few memory leaks

Changes in gstreamer-plugins-ugly:

• Update to version 1.26.7:
  • No changes, stable version bump only.

Changes in gstreamer-plugins-rs:

• Update to version 1.26.7+git0.6ab75814:

  • tracers: Fix inverted append logic when writing log files

  • threadshare:

    • examples: standalone: also handle buffer lists
    • Pad push_list: downgrade Pad flushing log level
    • sinks: fix / handle query()
    • backpressure: abort pending items on flush start
    • udpsink: fix panic recalculating latency from certain executors
    • audiotestsrc: . support more Audio formats . use AudioInfo . fix latency . act as a pseudo live source by default
    • runtime task: execute action in downward transition
    • example cleanups
    • udpsink: distinguish sync status for latency & report added latency
    • sink elements: implement send_event
    • dataqueue elements: report min and max latency

  • rtp:

    • Add linear audio (L8, L16, L24) RTP payloaders / depayloaders

  • rtp: basedepay: reuse last PTS, when possible

  • skia: Update to skia-safe 0.89

  • mp4: Update to mp4-atom 0.9

  • Update dependencies

  • webrtc: livekit: Drop connection lock after take()

  • onvifmetadatapay: copy metadata from source buffer

  • fallbacksrc: Fix custom source reuse case

  • add rust-tls-native-roots feature to the reqwest dep

  • rtpamrpay2:

    • Actually forward the frame quality indicator
    • Set frame quality indicator flag

• Add patch to fix reproducibility of package build (boo#1237097)

• Update to version 1.26.6+git20.e287e869:

  • Fix some new clippy 1.90 warnings
  • colordetect: Don't use deprecated color_name API
  • deny: Update
  • quinn: Update to web-transport-quinn 0.8
  • skia: Update to skia-safe 0.88
  • Update Cargo.lock
  • Allow windows-sys 0.61 too
  • intersink: add sync property
  • meson: Fix .pc files installation and simplify build output handling. This also fixes the .pc file install directory and ensures that the .pc files are only installed when static builds is enabled.

• Drop devel subpackage following upstream changes.

• Update to version 1.26.6:

  • aws: Ensure task stopping on paused-to-ready state change

  • fallbacksrc:

    • Don't panic during retries if the element was shut down in parallel
    • Don't restart source if the element is just being shut down
    • Fix some custom source deadlocks
    • Fix sources only being restarted once

  • gtk4: Try importing dmabufs withouth DMA_DRM caps

  • inter: Give the appsrc/appsink a name that has the parent element as prefix

  • mp4: Skip tests using x264enc if it does not exist

  • rtpgccbwe: avoid clamp() panic when min_bitrate > max_bitrate

  • rtpmp4gdepay2: allow only constantduration with neither constantsize nor sizelength set

  • rtprecv: fix race condition on first buffer

  • speechmatics: Specify rustls as an explicit dependency

  • spotify: update to librespot 0.7

  • threadshare:

    • add a blocking adapter element
    • always use block_on_or_add_subtask
    • audiotestsrc: fix setting samples-per-buffer...
    • blocking_adapter: fix Since marker in docs
    • fix resources not available when preparing asynchronously
    • fix ts-inter test one_to_one_up_first
    • have: have Task log its obj
    • intersink: return from blocking tasks when stopping
    • inter: update doc example
    • runtime/pad: lower log level pushing Buffer to flushing pad
    • separate blocking & throttling…

This update for rust-keylime fixes the following issues:

• Update to version 0.2.8+116:
• CVE-2026-25727: Update vendored crates to fix a date parser can lead to stack exhaustion in Time. (bsc#1257908)

This update for glycin-loaders fixes the following issues

• CVE-2025-55159: slab: incorrect bounds check in get_disjoint_mut function can lead to undefined behavior or potential crash due to out-of-bounds access (bsc#1248035).
• CVE-2025-58160: tracing-subscriber: Tracing log pollution (bsc#1249010).