{"id":"CVE-2025-55159","aliases":["AZL-74897","EUVD-2025-24190","GHSA-qx2v-8332-m4fv","OESA-2025-2098","OESA-2026-2817","OESA-2026-2818","OESA-2026-2819","OESA-2026-3047","RUSTSEC-2025-0047","SUSE-RU-2025:4131-1","SUSE-SU-2025:02957-1","SUSE-SU-2025:02961-1","SUSE-SU-2025:02962-1","SUSE-SU-2025:20717-1","SUSE-SU-2025:20858-1","SUSE-SU-2025:20921-1","SUSE-SU-2025:3944-1","SUSE-SU-2025:3954-1","SUSE-SU-2025:3955-1","SUSE-SU-2026:20686-1","SUSE-SU-2026:20744-1","SUSE-SU-2026:22302-1","UBUNTU-CVE-2025-55159","openSUSE-SU-2025:15444-1","openSUSE-SU-2025:15445-1","openSUSE-SU-2025:15446-1","openSUSE-SU-2025:15461-1","openSUSE-SU-2025:15470-1","openSUSE-SU-2025:15475-1","openSUSE-SU-2025:15480-1","openSUSE-SU-2025:15492-1","openSUSE-SU-2025:15497-1","openSUSE-SU-2025:15554-1","openSUSE-SU-2025:20013-1","openSUSE-SU-2026:10496-1","openSUSE-SU-2026:11324-1","openSUSE-SU-2026:11475-1","openSUSE-SU-2026:12171-1","openSUSE-SU-2026:20329-1","openSUSE-SU-2026:20364-1","openSUSE-SU-2026:21134-1","openSUSE-SU-2026:21560-1","openSUSE-SU-2026:21584-1","openSUSE-SU-2026:21605-1"],"status":"published","title":"slab allows out-of-bounds access in `get_disjoint_mut` due to incorrect bounds check","description":"slab is a pre-allocated storage for a uniform data type. In version 0.4.10, the get_disjoint_mut method incorrectly checked if indices were within the slab's capacity instead of its length, allowing access to uninitialized memory. This could lead to undefined behavior or potential crashes. This has been fixed in slab 0.4.11. A workaround for this issue involves to avoid using get_disjoint_mut with indices that might be beyond the slab's actual length.","severity":{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00185,"percentile":0.08202,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119"],"published":"2025-08-11T22:45:20Z","modified":"2026-10-28T02:30:42Z","fixes":[{"ecosystem":"crates.io","package":"slab","fixed_in":["0.4.11"],"sources":["ghsa","osv"]},{"ecosystem":"Azure Linux:3","package":"rust","fixed_in":["1.90.0-4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"gnome-tour","fixed_in":["3.38.0-3.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"gnome-tour","fixed_in":["44.0-3.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"gnome-tour","fixed_in":["44.0-2.oe2403sp3"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP4","package":"gnome-tour","fixed_in":["44.0-3.oe2403sp4"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"SLES16-Migration","fixed_in":["2.1.26-15.22.4"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"python-Cerberus","fixed_in":["1.3.2-150700.20.2.10"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"suse-migration-services","fixed_in":["2.1.26-150700.16.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"suse-migration-sle16-activation","fixed_in":["2.1.26-150700.15.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"wicked2nm","fixed_in":["1.4.0-150700.15.7.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for SAP Applications 15 SP7","package":"SLES16-SAP_Migration","fixed_in":["2.1.26-15.14.4"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"rust-keylime","fixed_in":["0.2.8+12-150400.3.10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"rust-keylime","fixed_in":["0.2.8+12-150400.3.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"rust-keylime","fixed_in":["0.2.8+12-150500.3.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"flake-pilot","fixed_in":["3.1.22-160000.1.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"flake-pilot","fixed_in":["3.1.22-160000.1.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP6","package":"sccache","fixed_in":["0.4.2~4-150600.10.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"sccache","fixed_in":["0.4.2~4-150600.10.6.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"sccache","fixed_in":["0.4.2~4-150600.10.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.2","package":"gstreamer","fixed_in":["1.26.7-160000.1.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.2","package":"gstreamer-plugins-base","fixed_in":["1.26.7-160000.1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"framework_tool","fixed_in":["0.4.5-2.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"gstreamer-devtools","fixed_in":["1.26.5-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"gstreamer-plugins-rs","fixed_in":["1.26.5+git11.949807a4-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"aws-efs-utils","fixed_in":["2.3.3-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"wicked2nm","fixed_in":["1.2.1-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"flake-pilot","fixed_in":["3.1.21-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"rust-keylime","fixed_in":["0.2.8+12-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"fractal","fixed_in":["12.0-3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"scx","fixed_in":["1.0.15-2.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"watchexec","fixed_in":["2.3.2-2.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"flake-pilot","fixed_in":["3.1.22-160000.1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"git-cliff","fixed_in":["2.12.0-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"afterburn","fixed_in":["5.10.0.git73.b97f772-2.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"ab-av1","fixed_in":["0.11.7-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"gstreamer","fixed_in":["1.26.7-160000.1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"gstreamer-devtools","fixed_in":["1.26.7-160000.1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"gstreamer-docs","fixed_in":["1.26.7-160000.1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"gstreamer-plugins-bad","fixed_in":["1.26.7-160000.1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"gstreamer-plugins-base","fixed_in":["1.26.7-160000.1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"gstreamer-plugins-good","fixed_in":["1.26.7-160000.1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"gstreamer-plugins-libav","fixed_in":["1.26.7-160000.1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"gstreamer-plugins-rs","fixed_in":["1.26.7+git0.6ab75814-160000.1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"gstreamer-plugins-ugly","fixed_in":["1.26.7-160000.1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"gstreamer-rtsp-server","fixed_in":["1.26.7-160000.1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"slab","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.4.10"},{"last_affected":"0.4.10"},{"fixed":"0.4.11"}]}],"versions":["0.4.10"]},{"source":"osv","ecosystem":"Azure Linux:3","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.85.0"},{"fixed":"1.90.0-4"}]}]},{"source":"osv","ecosystem":"crates.io","package":"slab","ranges":[{"type":"SEMVER","events":[{"introduced":"0.4.10"},{"fixed":"0.4.11"}]}],"versions":["0.4.10"]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP2","package":"uv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.8-1.oe2403sp2"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"gnome-tour","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.38.0-3.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"gnome-tour","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"44.0-3.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"gnome-tour","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"44.0-2.oe2403sp3"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"gnome-tour","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"44.0-3.oe2403sp4"}]}]},{"source":"osv","ecosystem":"crates.io","package":"slab","ranges":[{"type":"SEMVER","events":[{"introduced":"0.4.10"},{"fixed":"0.4.11"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"SLES16-Migration","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.26-15.22.4"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"python-Cerberus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.2-150700.20.2.10"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"suse-migration-services","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.26-150700.16.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"suse-migration-sle16-activation","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.26-150700.15.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"wicked2nm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0-150700.15.7.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for SAP Applications 15 SP7","package":"SLES16-SAP_Migration","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.26-15.14.4"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"rust-keylime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.8+12-150400.3.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"rust-keylime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.8+12-150400.3.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"rust-keylime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.8+12-150500.3.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"rust-keylime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.8+12-1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"rust-keylime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.8+12-slfo.1.1_1.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"flake-pilot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.22-160000.1.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"flake-pilot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.22-160000.1.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP6","package":"sccache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.2~4-150600.10.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"sccache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.2~4-150600.10.6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"sccache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.2~4-150600.10.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP6","package":"aws-efs-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.3-150600.17.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP7","package":"aws-efs-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.3-150600.17.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"aws-efs-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.3-150600.17.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"gstreamer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.7-160000.1.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.7-160000.1.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"rust-keylime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.8+116-160000.1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"glycin-loaders","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.1-160000.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"glycin-loaders","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.1-160000.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"rust-slab","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.4.1-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"rust-slab","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.4.1-1","0.4.4-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"rust-slab","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.4.4-1","0.4.9-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"rust-slab","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.4.9-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"rust-slab","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.4.9-1","0.4.12-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"rust-slab","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.4.9-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"framework_tool","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.5-2.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"gstreamer-devtools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.5-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"gstreamer-plugins-rs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.5+git11.949807a4-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"aws-efs-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.3-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"wicked2nm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.1-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"flake-pilot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.21-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rust-keylime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.8+12-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"fractal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0-3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"scx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.15-2.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"watchexec","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.2-2.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"flake-pilot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.22-160000.1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"git-cliff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12.0-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"afterburn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.10.0.git73.b97f772-2.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"kak-lsp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.0.2-1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ab-av1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.7-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"gstreamer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.7-160000.1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"gstreamer-devtools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.7-160000.1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"gstreamer-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.7-160000.1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"gstreamer-plugins-bad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.7-160000.1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"gstreamer-plugins-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.7-160000.1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"gstreamer-plugins-good","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.7-160000.1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"gstreamer-plugins-libav","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.7-160000.1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"gstreamer-plugins-rs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.7+git0.6ab75814-160000.1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"gstreamer-plugins-ugly","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.7-160000.1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"gstreamer-rtsp-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.7-160000.1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"rust-keylime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.8+116-160000.1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"glycin-loaders","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.1-160000.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"kak-lsp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.0.2-bp160.1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"git-cliff","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13.1-bp160.1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"forgejo-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.0-bp160.1.1"}]}],"bundled":3}],"products":[{"vendor":"tokio-rs","product":"slab"}],"references":[{"url":"https://github.com/tokio-rs/slab/security/advisories/GHSA-qx2v-8332-m4fv","tags":["x_refsource_CONFIRM","advisory","web","report"]},{"url":"https://github.com/tokio-rs/slab/pull/152","tags":["x_refsource_MISC","fix","web","report"]},{"url":"https://github.com/tokio-rs/slab/commit/2d65c514bc964b192bab212ddf3c1fcea4ae96b8","tags":["x_refsource_MISC","fix","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-55159","tags":["web","advisory"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2025-0047.html","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-qx2v-8332-m4fv"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/55xxx/CVE-2025-55159.json","tags":["advisory"]},{"url":"https://github.com/tokio-rs/slab","tags":["package"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2098","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-54368","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2817","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2818","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2819","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3047","tags":["advisory"]},{"url":"https://crates.io/crates/slab","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/-2025-4131/suse-ru-20254131-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1133919","tags":["report"]},{"url":"https://bugzilla.suse.com/1142108","tags":["report"]},{"url":"https://bugzilla.suse.com/1155192","tags":["report"]},{"url":"https://bugzilla.suse.com/1173532","tags":["report"]},{"url":"https://bugzilla.suse.com/1178737","tags":["report"]},{"url":"https://bugzilla.suse.com/1182520","tags":["report"]},{"url":"https://bugzilla.suse.com/1199028","tags":["report"]},{"url":"https://bugzilla.suse.com/1209304","tags":["report"]},{"url":"https://bugzilla.suse.com/1209591","tags":["report"]},{"url":"https://bugzilla.suse.com/1211240","tags":["report"]},{"url":"https://bugzilla.suse.com/1219004","tags":["report"]},{"url":"https://bugzilla.suse.com/1222258","tags":["report"]},{"url":"https://bugzilla.suse.com/1244188","tags":["report"]},{"url":"https://bugzilla.suse.com/1246513","tags":["report"]},{"url":"https://bugzilla.suse.com/1248010","tags":["report"]},{"url":"https://bugzilla.suse.com/1248137","tags":["report"]},{"url":"https://bugzilla.suse.com/1250076","tags":["report"]},{"url":"https://bugzilla.suse.com/1250078","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-55159","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502957-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1248006","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502961-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502962-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520717-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1242623","tags":["report"]},{"url":"https://bugzilla.suse.com/1247193","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-58266","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-3416","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520858-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1229952","tags":["report"]},{"url":"https://bugzilla.suse.com/1230029","tags":["report"]},{"url":"https://bugzilla.suse.com/1243861","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-12224","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-43806","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520921-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1248004","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20253944-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1248003","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20253954-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1240044","tags":["report"]},{"url":"https://bugzilla.suse.com/1248055","tags":["report"]},{"url":"https://bugzilla.suse.com/1249851","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-35881","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20253955-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620686-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1237097","tags":["report"]},{"url":"https://bugzilla.suse.com/1248053","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620744-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1257908","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58266","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25727","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622302-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1248035","tags":["report"]},{"url":"https://bugzilla.suse.com/1249010","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58160","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2025-55159","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-55159","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25541","tags":["web"]},{"url":"https://bugzilla.suse.com/1242654","tags":["report"]},{"url":"https://bugzilla.suse.com/1248048","tags":["report"]},{"url":"https://bugzilla.suse.com/1274502","tags":["report"]},{"url":"https://bugzilla.suse.com/1248065","tags":["report"]},{"url":"https://bugzilla.suse.com/1274523","tags":["report"]},{"url":"https://bugzilla.suse.com/1242683","tags":["report"]},{"url":"https://bugzilla.suse.com/1248047","tags":["report"]},{"url":"https://bugzilla.suse.com/1274529","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2025-55159","title":"slab allows out-of-bounds access in `get_disjoint_mut` due to incorrect bounds check","description":"slab is a pre-allocated storage for a uniform data type. In version 0.4.10, the get_disjoint_mut method incorrectly checked if indices were within the slab's capacity instead of its length, allowing access to uninitialized memory. This could lead to undefined behavior or potential crashes. This has been fixed in slab 0.4.11. A workaround for this issue involves to avoid using get_disjoint_mut with indices that might be beyond the slab's actual length.","status":"published","published":"2025-08-11T23:00:58.915Z","modified":"2025-08-12T14:07:00.276Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:32:52.839698Z"}],"euvd":[{"id":"EUVD-2025-24190","description":"slab is a pre-allocated storage for a uniform data type. In version 0.4.10, the get_disjoint_mut method incorrectly checked if indices were within the slab's capacity instead of its length, allowing access to uninitialized memory. This could lead to undefined behavior or potential crashes. This has been fixed in slab 0.4.11. A workaround for this issue involves to avoid using get_disjoint_mut with indices that might be beyond the slab's actual length.","status":"published","published":"2025-08-11T23:00:58Z","modified":"2025-08-12T14:07:00Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T20:31:59.474585Z"}],"ghsa":[{"id":"GHSA-qx2v-8332-m4fv","title":"slab allows out-of-bounds access in `get_disjoint_mut` due to incorrect bounds check","description":"### Impact\n\nThe `get_disjoint_mut` method in slab v0.4.10 incorrectly checked if indices were within the slab's capacity instead of its length, allowing access to uninitialized memory. This could lead to undefined behavior or potential crashes.\n\n### Patches\n\nThis has been fixed in slab v0.4.11.\n\n### Workarounds\n\nAvoid using `get_disjoint_mut` with indices that might be beyond the slab's actual length, or upgrade to v0.4.11 or later.\n\n### References\n\n- [https://github.com/tokio-rs/slab/pull/152](https://github.com/tokio-rs/slab/pull/152)","status":"published","published":"2025-08-11T22:45:20Z","modified":"2025-08-12T13:17:02Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:38:53.767052Z"}],"nvd":[{"id":"CVE-2025-55159","description":"slab is a pre-allocated storage for a uniform data type. In version 0.4.10, the get_disjoint_mut method incorrectly checked if indices were within the slab's capacity instead of its length, allowing access to uninitialized memory. This could lead to undefined behavior or potential crashes. This has been fixed in slab 0.4.11. A workaround for this issue involves to avoid using get_disjoint_mut with indices that might be beyond the slab's actual length.","status":"published","published":"2025-08-11T23:15:28.173Z","modified":"2026-06-17T09:41:22.573Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:11:22.953396Z"}],"osv":[{"id":"CVE-2025-55159","title":"slab allows out-of-bounds access in `get_disjoint_mut` due to incorrect bounds check","description":"slab is a pre-allocated storage for a uniform data type. In version 0.4.10, the get_disjoint_mut method incorrectly checked if indices were within the slab's capacity instead of its length, allowing access to uninitialized memory. This could lead to undefined behavior or potential crashes. This has been fixed in slab 0.4.11. A workaround for this issue involves to avoid using get_disjoint_mut with indices that might be beyond the slab's actual length.","status":"published","published":"2025-08-11T23:00:58.915Z","modified":"2026-10-28T02:30:42.832258191Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T15:44:50.863921Z"},{"id":"GHSA-qx2v-8332-m4fv","title":"slab allows out-of-bounds access in `get_disjoint_mut` due to incorrect bounds check","description":"### Impact\n\nThe `get_disjoint_mut` method in slab v0.4.10 incorrectly checked if indices were within the slab's capacity instead of its length, allowing access to uninitialized memory. This could lead to undefined behavior or potential crashes.\n\n### Patches\n\nThis has been fixed in slab v0.4.11.\n\n### Workarounds\n\nAvoid using `get_disjoint_mut` with indices that might be beyond the slab's actual length, or upgrade to v0.4.11 or later.\n\n### References\n\n- [https://github.com/tokio-rs/slab/pull/152](https://github.com/tokio-rs/slab/pull/152)","status":"published","published":"2025-08-11T22:45:20Z","modified":"2026-09-10T03:50:27.410724478Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T15:46:55.122811Z"},{"id":"OESA-2025-2098","title":"uv security update","description":"An extremely fast Python package and project manager, written in Rust.\r\n\r\nSecurity Fix(es):\n\nuv is a Python package and project manager written in Rust. In versions 0.8.5 and earlier, remote ZIP archives were handled in a streamwise fashion, and file entries were not reconciled against the archive\u0026apos;s central directory. An attacker could contrive a ZIP archive that would extract with legitimate contents on some package installers, and malicious contents on others due to multiple local file entries. An attacker could  also contrive a \u0026quot;stacked\u0026quot; ZIP input with multiple internal ZIPs, which would be handled differently by different package installers. The attacker could choose which installer to target in both scenarios. This issue is fixed in version 0.8.6. To work around this issue, users may choose to set UV_INSECURE_NO_ZIP_VALIDATION=1 to revert to the previous behavior.(CVE-2025-54368)\n\nslab is a pre-allocated storage for a uniform data type. In version 0.4.10, the get_disjoint_mut method incorrectly checked if indices were within the slab\u0026apos;s capacity instead of its length, allowing access to uninitialized memory. This could lead to undefined behavior or potential crashes. This has been fixed in slab 0.4.11. A workaround for this issue involves to avoid using get_disjoint_mut with indices that might be beyond the slab\u0026apos;s actual length.(CVE-2025-55159)","status":"published","published":"2025-09-05T11:09:11Z","modified":"2026-08-18T01:18:08.526255449Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"OESA-2026-2817","title":"gnome-tour security update","description":"A guided tour and greeter for GNOME.Tour uses by default the logo of the distribution based on the info from `/etc/os-release`. The application comes with a feature to replace the logo with a welcome video shipped by the distribution.\r\n\r\nSecurity Fix(es):\n\nslab is a pre-allocated storage for a uniform data type. In version 0.4.10, the get_disjoint_mut method incorrectly checked if indices were within the slab\u0026apos;s capacity instead of its length, allowing access to uninitialized memory. This could lead to undefined behavior or potential crashes. This has been fixed in slab 0.4.11. A workaround for this issue involves to avoid using get_disjoint_mut with indices that might be beyond the slab\u0026apos;s actual length.(CVE-2025-55159)","status":"published","published":"2026-07-06T11:11:44Z","modified":"2026-08-18T01:21:12.459712285Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"OESA-2026-2818","title":"gnome-tour security update","description":"A guided tour and greeter for GNOME.Tour uses by default the logo of the distribution based on the info from `/etc/os-release`. The application comes with a feature to replace the logo with a welcome video shipped by the distribution.\r\n\r\nSecurity Fix(es):\n\nslab is a pre-allocated storage for a uniform data type. In version 0.4.10, the get_disjoint_mut method incorrectly checked if indices were within the slab\u0026apos;s capacity instead of its length, allowing access to uninitialized memory. This could lead to undefined behavior or potential crashes. This has been fixed in slab 0.4.11. A workaround for this issue involves to avoid using get_disjoint_mut with indices that might be beyond the slab\u0026apos;s actual length.(CVE-2025-55159)","status":"published","published":"2026-07-06T11:11:44Z","modified":"2026-08-18T01:21:12.463299066Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"OESA-2026-2819","title":"gnome-tour security update","description":"A guided tour and greeter for GNOME.Tour uses by default the logo of the distribution based on the info from `/etc/os-release`. The application comes with a feature to replace the logo with a welcome video shipped by the distribution.\r\n\r\nSecurity Fix(es):\n\nslab is a pre-allocated storage for a uniform data type. In version 0.4.10, the get_disjoint_mut method incorrectly checked if indices were within the slab\u0026apos;s capacity instead of its length, allowing access to uninitialized memory. This could lead to undefined behavior or potential crashes. This has been fixed in slab 0.4.11. A workaround for this issue involves to avoid using get_disjoint_mut with indices that might be beyond the slab\u0026apos;s actual length.(CVE-2025-55159)","status":"published","published":"2026-07-06T11:11:44Z","modified":"2026-08-18T01:21:12.485215177Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"OESA-2026-3047","title":"gnome-tour security update","description":"A guided tour and greeter for GNOME.Tour uses by default the logo of the distribution based on the info from `/etc/os-release`. The application comes with a feature to replace the logo with a welcome video shipped by the distribution.\r\n\r\nSecurity Fix(es):\n\nslab is a pre-allocated storage for a uniform data type. In version 0.4.10, the get_disjoint_mut method incorrectly checked if indices were within the slab\u0026apos;s capacity instead of its length, allowing access to uninitialized memory. This could lead to undefined behavior or potential crashes. This has been fixed in slab 0.4.11. A workaround for this issue involves to avoid using get_disjoint_mut with indices that might be beyond the slab\u0026apos;s actual length.(CVE-2025-55159)","status":"published","published":"2026-07-19T11:11:56Z","modified":"2026-08-18T01:21:19.945976948Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"UBUNTU-CVE-2025-55159","description":"slab is a pre-allocated storage for a uniform data type. In version 0.4.10, the get_disjoint_mut method incorrectly checked if indices were within the slab's capacity instead of its length, allowing access to uninitialized memory. This could lead to undefined behavior or potential crashes. This has been fixed in slab 0.4.11. A workaround for this issue involves to avoid using get_disjoint_mut with indices that might be beyond the slab's actual length.","status":"published","published":"2025-08-11T23:15:00Z","modified":"2026-10-17T12:57:07.932856709Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T16:55:50.817402Z"},{"id":"AZL-74897","title":"CVE-2025-55159 affecting package rust for versions less than 1.90.0-4","description":"slab is a pre-allocated storage for a uniform data type. In version 0.4.10, the get_disjoint_mut method incorrectly checked if indices were within the slab's capacity instead of its length, allowing access to uninitialized memory. This could lead to undefined behavior or potential crashes. This has been fixed in slab 0.4.11. A workaround for this issue involves to avoid using get_disjoint_mut with indices that might be beyond the slab's actual length.","status":"published","published":"2025-08-11T23:15:28Z","modified":"2026-09-08T17:33:11Z","updated_at":"2026-11-02T15:28:09.474476Z"},{"id":"openSUSE-SU-2025:15444-1","title":"framework_tool-0.4.5-2.1 on GA media","description":"These are all security issues fixed in the framework_tool-0.4.5-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-08-15T00:00:00Z","modified":"2026-03-23T04:53:47.458274Z","updated_at":"2026-11-02T16:58:37.810934Z"},{"id":"openSUSE-SU-2025:15445-1","title":"gstreamer-devtools-1.26.5-1.1 on GA media","description":"These are all security issues fixed in the gstreamer-devtools-1.26.5-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-08-15T00:00:00Z","modified":"2026-03-23T04:53:47.320299Z","updated_at":"2026-11-02T16:58:37.810934Z"},{"id":"openSUSE-SU-2025:15446-1","title":"gstreamer-plugins-rs-1.26.5+git11.949807a4-1.1 on GA media","description":"These are all security issues fixed in the gstreamer-plugins-rs-1.26.5+git11.949807a4-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-08-15T00:00:00Z","modified":"2026-03-23T04:53:47.480729Z","updated_at":"2026-11-02T16:58:37.810934Z"},{"id":"openSUSE-SU-2025:15461-1","title":"aws-efs-utils-2.3.3-1.1 on GA media","description":"These are all security issues fixed in the aws-efs-utils-2.3.3-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-08-19T00:00:00Z","modified":"2026-03-23T04:53:48.784835Z","updated_at":"2026-11-02T16:58:37.810934Z"},{"id":"openSUSE-SU-2025:15470-1","title":"wicked2nm-1.2.1-1.1 on GA media","description":"These are all security issues fixed in the wicked2nm-1.2.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-08-20T00:00:00Z","modified":"2026-03-23T04:53:49.631391Z","updated_at":"2026-11-02T16:58:37.810934Z"},{"id":"openSUSE-SU-2025:15475-1","title":"flake-pilot-3.1.21-1.1 on GA media","description":"These are all security issues fixed in the flake-pilot-3.1.21-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-08-21T00:00:00Z","modified":"2026-03-23T04:53:49.846552Z","updated_at":"2026-11-02T16:58:37.810934Z"},{"id":"openSUSE-SU-2025:15480-1","title":"keylime-ima-policy-0.2.8+12-1.1 on GA media","description":"These are all security issues fixed in the keylime-ima-policy-0.2.8+12-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-08-21T00:00:00Z","modified":"2026-03-23T04:53:50.514637Z","updated_at":"2026-11-02T16:58:37.810934Z"},{"id":"openSUSE-SU-2025:15492-1","title":"fractal-12.0-3.1 on GA media","description":"These are all security issues fixed in the fractal-12.0-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-08-26T00:00:00Z","modified":"2026-03-23T04:53:50.764759Z","updated_at":"2026-11-02T16:58:37.810934Z"},{"id":"openSUSE-SU-2025:15497-1","title":"scx-1.0.15-2.1 on GA media","description":"These are all security issues fixed in the scx-1.0.15-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-08-27T00:00:00Z","modified":"2026-03-23T04:53:51.704797Z","updated_at":"2026-11-02T16:58:37.810934Z"},{"id":"openSUSE-SU-2025:15554-1","title":"watchexec-2.3.2-2.1 on GA media","description":"These are all security issues fixed in the watchexec-2.3.2-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-09-15T00:00:00Z","modified":"2026-03-23T04:53:55.914046Z","updated_at":"2026-11-02T16:58:37.810934Z"},{"id":"openSUSE-SU-2025:20013-1","title":"Recommended update of flake-pilot","description":"This update for flake-pilot fixes the following issues:\n\nUpdate version to 3.1.22.\n\n- Fixes to use flakes as normal user\n\n  Running a flake is a container based instance provisioning\n  and startup. Some part of this process requires root permissions\n  for example mounting the container instance store for the\n  provisioning step. This commit fixes the required calls to\n  be properly managed by sudo.\n\n- seed from entropy\n\n- Fix assignment of random sequence number\n\n  We should use a seed for the sequence as described in\n  https://rust-random.github.io/book/guide-seeding.html#a-simple-number\n  In addition the logic when a random sequence number should\n  be used was wrong and needed a fix regarding resume and\n  attach type flakes which must not use a random sequence\n\n- Pass --init option for resume type flakes\n\n  In resume mode a sleep command is used to keep the container\n  open. However, without the --init option there is no signal\n  handling available. This commit fixes it\n\n- Revert \"kill prior remove when using %remove flag\"\n\n  This reverts commit 06c7d4aa71f74865dfecba399fd08cc2fde2e1f2.\n  no hard killing needed with the event loop entrypoint\n\n- Fixed CVE-2025-55159 slab: incorrect bounds check\n\n  Update to slab 0.4.11 to fix the mentioned CVE.\n  This Fixes bsc#1248004\n\n- Apply clippy fixes\n\n- Create sequence number for the same invocation\n\n  If a flake which is not a resume or attach flake is called twice\n  with the same invocation arguments an error message is displayed\n  to give this invocation a new name via the @NAME runtime option.\n  This commit makes this more comfortable and automatically assigns\n  a random sequence number for the call if no @NAME is given.\n\n- kill prior remove when using %remove flag\n\n  In case the container instance should be removed via the %remove\n  flag, send a kill first, followed by a force remove. The reason\n  for this is because we use a never ending sleep command as entry\n  point for resume type containers. If they should be removed the\n  standard signal send on podman rm will not stop the sleep and\n  after a period of 10 seconds podman sends a kill signal itself.\n  We can speedup this process as we know the entry point command\n  and send the kill signal first followed by the remove which\n  saves us some wait time spent in podman otherwise.\n\n- Fix clippy hints\n\n  variables can be used directly in the format! string\n\n- Prune old images after load\n\n  Make sure no \u003cnone\u003e image references stay in the registry\n\n","status":"published","published":"2025-10-15T12:01:21Z","modified":"2026-03-23T04:54:15.125315Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"openSUSE-SU-2026:10496-1","title":"git-cliff-2.12.0-1.1 on GA media","description":"These are all security issues fixed in the git-cliff-2.12.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-04-07T00:00:00Z","modified":"2026-04-08T07:50:15.973173Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"openSUSE-SU-2026:11324-1","title":"afterburn-5.10.0.git73.b97f772-2.1 on GA media","description":"These are all security issues fixed in the afterburn-5.10.0.git73.b97f772-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-22T00:00:00Z","modified":"2026-07-23T09:45:06.837229402Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:11475-1","title":"kak-lsp-21.0.2-1.1 on GA media","description":"These are all security issues fixed in the kak-lsp-21.0.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-08-09T00:00:00Z","modified":"2026-08-10T08:15:09.341957382Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:12171-1","title":"ab-av1-0.11.7-1.1 on GA media","description":"These are all security issues fixed in the ab-av1-0.11.7-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-18T00:00:00Z","modified":"2026-10-19T09:30:05.153624466Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:20329-1","title":"Security update for gstreamer-rtsp-server, gstreamer-plugins-ugly, gstreamer-plugins-rs, gstreamer-plugins-libav, gstreamer-plugins-good, gstreamer-plugins-base, gstreamer-plugins-bad, gstreamer-docs, gstreamer-devtools, gstreamer","description":"This update for gstreamer-rtsp-server, gstreamer-plugins-ugly, gstreamer-plugins-rs, gstreamer-plugins-libav, gstreamer-plugins-good, gstreamer-plugins-base, gstreamer-plugins-bad, gstreamer-docs, gstreamer-devtools, gstreamer fixes the following issues:\n\nChanges in gstreamer-rtsp-server:\n\n- Update to version 1.26.7:\n  + Fix issues with G_DISABLE_CHECKS \u0026 G_DISABLE_ASSERT.\n  + rtsp-server: tests: Switch to fixtures to ensure pool shutdown\n  + rtsp-server: tests: Fix a few memory leaks\n\nChanges in gstreamer-plugins-ugly:\n\n- Update to version 1.26.7:\n  + No changes, stable version bump only.\n\nChanges in gstreamer-plugins-rs:\n\n- Update to version 1.26.7+git0.6ab75814:\n\n  * tracers: Fix inverted append logic when writing log files\n  * threadshare:\n\n    - examples: standalone: also handle buffer lists\n    - Pad push_list: downgrade Pad flushing log level\n    - sinks: fix / handle query()\n    - backpressure: abort pending items on flush start\n    - udpsink: fix panic recalculating latency from certain\n      executors\n    - audiotestsrc:\n      . support more Audio formats\n      . use AudioInfo\n      . fix latency\n      . act as a pseudo live source by default\n    - runtime task: execute action in downward transition\n    - example cleanups\n    - udpsink: distinguish sync status for latency \u0026 report added\n      latency\n    - sink elements: implement `send_event`\n    - dataqueue elements: report min and max latency\n\n  * rtp:\n\n    - Add linear audio (L8, L16, L24) RTP payloaders / depayloaders\n\n  * rtp: basedepay: reuse last PTS, when possible\n  * skia: Update to skia-safe 0.89\n  * mp4: Update to mp4-atom 0.9\n  * Update dependencies\n  * webrtc: livekit: Drop connection lock after take()\n  * onvifmetadatapay: copy metadata from source buffer\n  * fallbacksrc: Fix custom source reuse case\n  * add `rust-tls-native-roots` feature to the `reqwest` dep\n  * rtpamrpay2:\n    - Actually forward the frame quality indicator\n    - Set frame quality indicator flag\n\n- Add patch to fix reproducibility of package build (boo#1237097)\n\n- Update to version 1.26.6+git20.e287e869:\n\n  * Fix some new clippy 1.90 warnings\n  * colordetect: Don't use deprecated color_name API\n  * deny: Update\n  * quinn: Update to web-transport-quinn 0.8\n  * skia: Update to skia-safe 0.88\n  * Update Cargo.lock\n  * Allow windows-sys 0.61 too\n  * intersink: add sync property\n  * meson: Fix .pc files installation and simplify build output\n    handling. This also fixes the .pc file install directory and\n    ensures that the .pc files are only installed when static\n    builds is enabled.\n- Drop devel subpackage following upstream changes.\n\n- Update to version 1.26.6:\n\n  + aws: Ensure task stopping on paused-to-ready state change\n  + fallbacksrc:\n\n    - Don't panic during retries if the element was shut down in\n      parallel\n    - Don't restart source if the element is just being shut down\n    - Fix some custom source deadlocks\n    - Fix sources only being restarted once\n\n  + gtk4: Try importing dmabufs withouth DMA_DRM caps\n  + inter: Give the appsrc/appsink a name that has the parent\n    element as prefix\n  + mp4: Skip tests using x264enc if it does not exist\n  + rtpgccbwe: avoid clamp() panic when min_bitrate \u003e max_bitrate\n  + rtpmp4gdepay2: allow only constantduration with neither\n    constantsize nor sizelength set\n  + rtprecv: fix race condition on first buffer\n  + speechmatics: Specify rustls as an explicit dependency\n  + spotify: update to librespot 0.7\n  + threadshare:\n\n    - add a blocking adapter element\n    - always use block_on_or_add_subtask\n    - audiotestsrc: fix setting samples-per-buffer...\n    - blocking_adapter: fix Since marker in docs\n    - fix resources not available when preparing asynchronously\n    - fix ts-inter test one_to_one_up_first\n    - have: have Task log its obj\n    - intersink: return from blocking tasks when stopping\n    - inter: update doc example\n    - runtime/pad: lower log level pushing Buffer to flushing pad\n    - separate blocking \u0026 throttling schedulers\n    - update examples\n    - Update to getifaddrs 0.5\n    - Fix macOS build post getifaddrs 0.5 update\n    - Bump up getiffaddrs to 0.1.5 and revert \"udp: avoid\n      getifaddrs in android\"\n    - Reapply \"udp: avoid getifaddrs in android\"\n\n  + transcriberbin: Fix some deadlocks\n  + Update dependencies\n  + webrtc: Migrate to warp 0.4 and switch to tokio-rustls\n  + webrtc/signalling: Fix setting of host address\n  + ci: add script to check readme against plugins list\n  + Fix various new clippy 1.89 warnings\n  + Don't suggest running cargo cinstall after cargo cbuild\n  + meson: Isolate built plugins from cargo target directory\n\n- Update to version 1.26.5+git11.949807a4 (boo#1248053,\n  CVE-2025-55159):\n\n  + rtprecv: fix race condition on first buffer\n  + threadshare: intersink: return from blocking tasks when\n    stopping\n  + threadshare: inter: store upstream latency in InterContext\n  + threadshare: add a blocking adapter element\n  + transcriberbin: Fix settings/state lock order violation in\n    set_property()\n  + transcriberbin: Don't keep state locked while querying upstream\n    latency\n  + threadshare: audiotestsrc: fix setting samples-per-buffer...\n  + rtpgccbwe: avoid clamp() panic when min_bitrate \u003e max_bitrate\n  + fallbacksrc: Don't restart source if the element is just being\n    shut down\n  + aws: Ensure task stopping on paused-to-ready state change\n  + fallbacksrc: Don't panic during retries if the element was shut\n    down in parallel\n  + Update Cargo.lock.\n\n- Update to version 1.26.5:\n\n  + awstranscriber2, awstranslate: Handle multiple stream-start\n    event\n  + ceaX08overlay: support ANY caps features, allowing e.g.\n    memory:GLMemory if downstream supports the overlay composition\n    meta\n  + hlsmultivariantsink: Fix master playlist version\n  + rtprecv: Drop state lock before chaining RTCP packets from the\n    RTP chain function\n  + Add rtpbin2 examples\n  + rtpmp4apay2: fix payload size prefix\n  + rtp: threadshare: fix some property ranges\n  + mpegtslivesrc: Remove leftover debug message\n  + ts-audiotestsrc fixes\n  + threadshare: fix flush for ts-queue ts-proxy \u0026 ts-intersrc\n  + threadshare: fix regression in ts-proxysrc\n  + threadshare: improvements to some elements\n  + threadshare: Enable windows Win32_Networking feature\n  + threadshare: queue \u0026 proxy: fix race condition stopping\n  + threadshare: Also enable windows Win32_Networking_WinSock\n    feature\n  + tracers: pipeline-snapshot: reduce WebSocket connection log\n    level\n  + tracers: queue-levels: add support for threadshare DataQueue\n    related elements\n  + tracers: Update to etherparse 0.19\n  + transcriberbin: Fix handling of upstream latency query\n  + webrtcsink: Move videorate before videoconvert and videoscale\n    to avoid processing frames that would be dropped\n  + Fix various new clippy 1.89 warnings\n\n- Update to version 1.26.4:\n  + aws: s3hlssink: Write to S3 on OutputStream flush\n  + cea708mux: fix clipping function\n  + dav1ddec: Use video decoder base class latency reporting API\n  + elevenlabssynthesizer: fix running time checks\n  + gopbuffer: Push GOPs in order of time on EOS\n  + gtk4: Improve color-state fallbacks for unknown values\n  + gtk4: Add YCbCr memory texture formats\n  + gtk4: Promote set_caps debug log to info\n  + hlssink3: Fix a comment typo\n  + hlssink3: Use closed fragment location in playlist generation\n  + livekit: add room-timeout\n  + mccparse: Convert \"U\" to the correct byte representation\n  + mp4mux: add TAI timestamp element and muxing\n  + threadshare: add a ts-rtpdtmfsrc element\n  + rtp: Update to rtcp-types 0.2\n  + rtpsend: Don't configure a zero min RTCP interval for senders\n  + rtpbin2: Fix handling of unknown PTs and don't warn about\n    incomplete RTP caps to allow for bundling\n  + rtpbin2: Improve rtcp-mux support\n  + rtpbin2: fix race condition on serialized Queries\n  + rtpbin2: sync: fix race condition\n  + rtprecv optimize src pad scheduling\n  + rtprecv: fix SSRC collision event sent in wrong direction\n  + skia: Add harfbuzz, freetype and fontconfig as dependencies in\n    the meson build\n  + tttocea{6,7}08: Disallow pango markup from input caps\n  + ts-intersrc: handle dynamic inter-ctx changes\n  + threadshare: src elements: don't pause the task in downward\n    state transitions\n  + webrtc: sink: avoid recursive locking of the session\n  + webrtcsink: fix deadlock on error setting remote description\n  + webrtcsink: add mitigation modes parameter and signal\n  + webrtc: fix Safari addIceCandidate crash\n  + webrtc-api: Set default bundle policy to max-bundle\n  + WHIP client: emit shutdown after DELETE request\n  + Fix various new clippy 1.88 warnings\n  + Update dependencies\n\n- Update to version 1.26.3:\n\n  + Add new speech synthesis element around ElevenLabs API\n  + cea708mux: fix another WouldOverflow case\n  + cea708mux: support configuring a limit to how much data will be\n    pending.\n  + cea708overlay: also reset the output size on flush stop\n  + gcc: handle out of order packets\n  + fmp4mux: Fix panic on late GOP\n  + livekit: expose a connection state property\n  + mp4mux: add taic box\n  + mp4mux: test the trak structure\n  + pcap_writer: Make target-property and pad-path properties\n    writable again\n  + skia: Don't build skia plugin by default for now\n  + threadshare: cleanups \u0026 usability improvements\n  + threadshare: sync runtime with latest async-io\n  + threadshare: fix kqueue reactor\n  + threadshare: Update to getifaddrs 0.2\n  + threadshare: add new thread-sharing inter elements\n  + threadshare: add a ts-rtpdtmfsrc element\n  + transcriberbin: fix naming of subtitle pads\n  + tttocea708: don't panic if a new service would overflow\n  + webrtc: android: Update Gradle and migrate to\n    FindGStreamerMobile\n  + webrtc: add new examples for stream selection over data channel\n  + webrtcsrc: the webrtcbin get-transceiver index is not\n    mlineindex\n  + webrtcsrc: send CustomUpstream events over control channel ..\n  + webrtcsink: Don't require encoder element for pre-encoded\n    streams\n  + webrtcsink: Don't reject caps events if the codec_data changes\n  + whip: server: pick session-id from the endpoint if specified\n  + cargo: add config file to force\n    CARGO_NET_GIT_FETCH_WITH_CLI=true\n  + Cargo.lock, deny: Update dependencies and log duplicated\n    targo-lexicon\n  + Update windows-sys dependency from \"\u003e=0.52, \u003c=0.59\" to \"\u003e=0.52,\n    \u003c=0.60\"\n  + deny: Add override for windows-sys 0.59\n  + deny: Update lints\n  + cargo_wrapper: Fix backslashes being parsed as escape codes on\n    Windows\n  + Fixes for Clock: non-optional return types\n  + Rename relationmeta plugin to analytics\n\nChanges in gstreamer-plugins-libav:\n\n- Update to version 1.26.7:\n\n  + No changes, stable versionbump only.\n\nChanges in gstreamer-plugins-good:\n\n- Update to version 1.26.7:\n\n  + matroskamux: Properly check if pads are EOS in find_best_pad\n  + qtdemux:\n    - Bad performance with GoPro videos containing FDSC metadata\n      tracks\n    - Fix open/seek perf for GoPro files with SOS track\n    - Handle unsupported channel layout tags gracefully\n    - Set channel-mask to 0 for unknown layout tags\n  + rtspsrc: Send RTSP keepalives in TCP/interleaved modes\n  + v4l2:\n    - Add GstV4l2Error handling in gst_v4l2_get_capabilities\n    - Fix memory leak for DRM caps negotiation\n  + v4l2transform: reconfigure v4l2object only if respective caps\n    changed\n  + Fix issues with G_DISABLE_CHECKS \u0026 G_DISABLE_ASSERT\n\n- Update to version 1.26.6:\n\n  + adaptivedemux2: fix crash due to log\n  + adaptivedemux2: Crash in logging when \"Dropping EOS before next\n    period\"\n  + hlsdemux2: Fix parsing of byterange and init map directives\n  + mpg123audiodec: Always break the decoding loop and relay\n    downstream flow errors upstream\n  + v4l2: Add support for WVC1 and WMV3\n  + Monorepo: dv plugin requires explicit enablement now for a\n    build using the Meson subproject fallback\n\n- Update to version 1.26.5:\n\n  + 4l2: fix memory leak for dynamic resolution change\n  + videorate, imagefreeze: add support for JPEG XS\n\n- Update to version 1.26.4:\n\n  + adaptivedemux2: Fixed reverse playback\n  + matroskademux: Send tags after seeking\n  + qtdemux: Fix incorrect FourCC used when iterating over sbgp\n    atoms\n  + qtdemux: Incorrect sibling type used in sbgp iteration loop\n  + rtph265pay: add profile-id, tier-flag, and level-id to output\n    rtp caps\n  + rtpjpeg: fix copying of quant data if it spans memory segments\n  + soup: Disable range requests when talking to Python's\n    http.server\n  + v4l2videodec: need replace acquired_caps on set_format success\n  + Fix various valgrind/test errors when GST_DEBUG is enabled\n  + More valgrind and test fixes\n  + Various ASAN fixes\n\n- Update to version 1.26.3:\n\n  + aacparse: Fix counting audio channels in program_config_element\n  + adaptivedemux2: free cancellable when freeing transfer task\n  + dashdemux2: Fix seeking in a stream with gaps\n  + decodebin wavparse cannot pull header\n  + imagefreeze: fix not negotiate log when stop\n  + osxvideosink: Use gst_pad_push_event() and post navigation\n    messages\n  + qml6glsink: Allow configuring if the item will consume input\n    events\n  + qtmux: Update chunk offsets when converting stco to co64 with\n    faststart\n  + splitmuxsink: Only send closed message once per open fragment\n  + rtph265depay: CRA_NUT can also start an (open) GOP\n  + rtph265depay: fix codec_data generation\n  + rtspsrc: Don't emit error during close if server is EOF\n  + twcc: Fix reference timestamp wrapping (again)\n  + v4l2: Fix possible internal pool leak\n  + v4l2object: Add support for colorimetry bt2100-pq and 1:4:5:3\n  + wavparse: Don't error out always when parsing acid chunks\n\nChanges in gstreamer-plugins-base:\n\n- Update to version 1.26.7:\n\n  + discoverer: Mark gst_discoverer_stream_info_list_free() as\n    transfer full\n  + riff: Add channel reorder maps for 3 and 7 channel audio\n  + sdp: proper usage of gst_buffer_append\n  + videorate: fix assert fail due to invalid buffer duration\n  + Fix build error with glib \u003c 2.68\n\n- Update to version 1.26.6:\n\n  + decodebin3: Update stream tags\n  + rtpbasedepayload: Avoid potential use-after free\n  + rtspconnection: Add get_url and get_ip return value annotation\n  + gst_rtsp_connection_get_url return value transfer annotation\n    missing\n  + videometa: Fix valgrind warning when deserializing video meta\n  + videorate: don't hold the reference to the buffer in drop-only\n    mode\n  + gst-device-monitor-1.0: Fix device-path regression on Windows\n  + gst-device-monitor-1.0: Add quoting for powershell and cmd\n  + Monorepo: opengl, vorbis, plugins require explicit enablement\n    now for a build using the Meson subproject fallback\n\n- Update to version 1.26.5:\n\n  + audioconvert: mix-matrix causes caps negotiation failure\n  + decodebin3: Don't error on an incoming ONVIF metadata stream\n  + gloverlay: Recompute geometry when caps change, and load\n    texture after stopping and starting again\n  + uridecodebin3: Add missing locking and NULL checks when adding\n    URIs to messages\n  + uridecodebin3: segfault in update_message_with_uri() if no\n    decoder available\n  + videorate, imagefreeze: add support for JPEG XS\n  + gst-device-monitor-1.0: Add shell quoting for launch lines\n  + gst-device-monitor-1.0: Fix criticals, and also accept utf8 in\n    launch lines\n  + gst-device-monitor-1.0: Use gst_print instead of g_print\n\n- Update to version 1.26.4:\n\n  + Revert \"streamsynchronizer: Consider streams having received\n    stream-start as waiting\"\n  + alsa: free conf cache under valgrind\n  + gst-device-monitor: Fix caps filter splitting\n  + Fix various valgrind/test errors when GST_DEBUG is enabled\n  + More valgrind and test fixes\n  + Various ASAN fixes\n\n- Update to version 1.26.3:\n\n  + GstAudioAggregator: fix structure unref in peek_next_sample()\n  + audioconvert: Fix setting mix-matrix when input caps changes\n  + encodebasebin: Duplicate encoding profile in property setter\n  + gl: simplify private\n    gst_gl_gst_meta_api_type_tags_contain_only()\n  + osxvideosink: Use gst_pad_push_event() and post navigation\n    messages\n  + playsink: Fix race condition in stream synchronizer pad cleanup\n    during state changes\n  + python: Fix pulling events from appsink\n  + streamsynchronizer: Consider streams having received\n    stream-start as waiting\n  + urisourcebin: Text tracks are no longer set as sparse stream in\n    urisourcebin's multiqueue\n\nChanges in gstreamer-plugins-bad:\n\n- Update to version 1.26.7:\n\n  + cuda: Fix runtime kernel compile with CUDA 13.0\n  + d3d12convert: Fix crop meta support\n  + d3d12deinterlace: Fix passthrough handling\n  + gst: Fix a few small leaks\n  + matroskamux: Properly check if pads are EOS in find_best_pad\n  + tsdemux: Directly forward Opus AUs without opus_control_header\n  + tsmux: Write a full Opus channel configuration if no matching\n    Vorbis one is found\n  + unixfd: Fix case of buffer with big payload\n  + vacompositor: Correct scale-method properties\n  + webrtc: nice: Fix a use-after-free and a mem leak\n  + Fix all compiler warnings on Fedora\n  + Fix issues with G_DISABLE_CHECKS \u0026 G_DISABLE_ASSERT\n\n- Update to version 1.26.6:\n\n  + analytics: always add GstTensorMeta\n  + cccombiner: Crash fixes\n  + curlsmtpsink: adapt to date formatting issue\n  + decklinkvideosrc: fix decklinkvideosrc becomes unrecoverable if\n    it fails to start streaming\n  + decklinkvideosrc gets into unrecoverable state if device is\n    busy\n  + dwrite: Fix D3D12 critical warning\n  + hlsdemux: Fix parsing of byterange and init map directives\n  + mpegtsmux: Caps event fails with stream type change error\n  + vulkanh24xdec: couple of fixes\n  + vulkanh26xdec: fix discont state handling\n  + waylandsink: add some error handler for event dispatch\n  + zbar: tests: Handle symbol-bytes as not null-terminated\n  + Monorepo: avtp, codec2json, iqa, microdns, openjpeg, qroverlay,\n    soundtouch, tinyalsa plugins require explicit enablement now\n    for a build using the Meson subproject fallback\n\n- Update to version 1.26.5:\n\n  + av1parse: Don't error out on \"currently\" undefined seq-level\n    indices\n  + av1parse: fails to parse AV1 bitstreams generated by FFmpeg\n    using the av1_nvenc hardware encoder\n  + d3d12screencapturedevice: Avoid false device removal on monitor\n    reconfiguration\n  + d3d12screencapturesrc: Fix OS handle leaks/random crash in WGC\n    mode\n  + meson: d3d12: Add support for MinGW DirectXMath package\n  + va: Re-negotiate after FLUSH\n  + vaXXXenc: calculate latency with corrected framerate\n  + vaXXXenc: fix potential race condition\n  + vkphysicaldevice: enable sampler ycbcr conversion,\n    synchronization2 and timeline semaphore features\n  + vulkan: ycbcr conversion extension got promoted in 1.1.0\n  + wasapi2: Port to IMMDevice based device selection\n\n- Fix really disabling faad when building without faad support.\n\n- Do not build with faad in SLE16 where faad2 is not available.\n\n- Update to version 1.26.4:\n\n  + avtp: crf: Setup socket during state change to ensure we handle\n    failure\n  + d3d12screencapture: Add support for monitor add/remove in\n    device provider\n  + mpegtsmux: fix double free caused by shared PMT descriptor\n  + openh264: Ensure src_pic is initialized before use\n  + rtmp2src: various fixes to make it play back AWS medialive\n    streams\n  + ssdobjectdetector: Use correct tensor data index for the scores\n  + v4l2codecs: h265dec: Fix zero-copy of cropped window located at\n    position 0,0\n  + vp9parse: Fix handling of spatial SVC decoding\n  + vp9parse: Revert \"Always default to super-frame\"\n  + vtenc: Fix negotiation failure with profile=main-422-10\n  + vulkan: Fix drawing too many triangles in fullscreenquad\n  + vulkanfullscreenquad: add locks for synchronisation\n  + Fix various valgrind/test errors when GST_DEBUG is enabled\n  + More valgrind and test fixes\n  + Various ASAN fixes\n\n- Provide and Obsolete gstreamer-1.20-plugin-openh264 too, not just\n  gstreamer-plugin-openh264.\n\n- Update to version 1.26.3:\n\n  + amc: Overhaul hw-accelerated video codecs detection\n  + bayer2rgb: Fix RGB stride calculation\n  + d3d12compositor: Fix critical warnings\n  + dashsink: Fix failing test\n  + decklink: calculate internal using values closer to the current\n    clock times\n  + decklinkvideosink: show preroll frame correctly\n  + decklink: clock synchronization after pause\n  + h266parser: Fix overflow when parsing subpic_level_info\n  + lcevcdec: Check for errors after receiving all enhanced and\n    base pictures\n  + meson: fix building -bad tests with disabled soundtouch\n  + mpegts: handle MPEG2-TS with KLV metadata safely by preventing\n    out of bounds\n  + mpegtsmux: Corrections around Teletext handling\n  + srtsink: Fix header buffer filtering\n  + transcoder: Fix uritranscodebin reference handling\n  + tsdemux: Allow access unit parsing failures\n  + tsdemux: Send new-segment before GAP\n  + vulkanupload: fix regression for uploading VulkanBuffer\n  + vulkanupload: fix regression when uploading to single memory\n    multiplaned memory images\n  + webrtcbin: disconnect signal ICE handlers on dispose\n  + {d3d12,d3d11}compositor: Fix negative position handling\n  + {nv,d3d12,d3d11}decoder: Use interlace info in input caps\n\n- Build with noopenh264, move plugin to main package.\n- Drop conditionals for fdk-aac, explicitly build it for all\n  targets.\n\n- Move faad plugin to main package.\n\nChanges in gstreamer-docs:\n\n- Update to version 1.26.7:\n  + No changes, stable bump only.\n  + Update docs.\n\nChanges in gstreamer-devtools:\n\n- Update to version 1.26.7:\n\n  + Fix issues with G_DISABLE_CHECKS \u0026 G_DISABLE_ASSERT\n\n- Update to version 1.26.6:\n\n  + validate: http-actions: Replace GUri with GstURI for GLib 2.64\n    compatibility\n  + Fix memory leak and use of incorrect context\n\n- Update to version 1.26.5:\n\n  + No changes, stable bump only.\n\n- Update vendored dependencies (boo#1248053, CVE-2025-55159).\n\n- Update to version 1.26.4:\n\n  + Update various Rust dependencies\n\n- Update to version 1.26.3:\n\n  + validate: More memory leaks\n  + validate: Valgrind fixes\n\nChanges in gstreamer:\n\n- Update to version 1.26.7:\n\n  + Highlighted bugfixes in 1.26.7:\n\n    - cea608overlay: improve handling of non-system memory\n    - cuda: Fix runtime kernel compile with CUDA 13.0\n    - d3d12: Fix crop meta support in converter and passthrough\n      handling in deinterlacer\n    - fallbacksrc: source handling improvements; no-more-pads\n      signal for streams-unaware parents\n    - inter: add properties to fine tune the inner elements\n    - qtdemux: surround sound channel layout handling fixes and\n      performance improvements for GoPro videos\n    - rtp: Add linear audio (L8, L16, L24) RTP payloaders /\n      depayloaders\n    - rtspsrc: Send RTSP keepalives in TCP/interleaved modes\n    - rtpamrpay2: frame quality indicator flag related fixes\n    - rtpbasepay2: reuse last PTS when possible, to work around\n      problems with NVIDIA Jetson AV1 encoder\n    - mpegtsmux, tsdemux: Opus audio handling fixes\n    - threadshare: latency related improvements and many other\n      fixes\n    - matroskamux, tsmux, flvmux, cea608mux: Best pad determination\n      fixes at EOS\n    - unixfd: support buffers with a big payload\n    - videorate unknown buffer duration assertion failure with\n      variable framerates\n    - editing services: Make GESTimeline respect\n      SELECT_ELEMENT_TRACK signal discard decision; memory leak\n      fixes\n    - gobject-introspection annotation fixes\n    - cerbero: Update meson to 1.9.0 to enable Xcode 26\n      compatibility\n    - Various bug fixes, build fixes, memory leak fixes, and other\n      stability and reliability improvements\n\n  + gstreamer:\n\n    - controller: Fix get_all() return type annotation\n    - gst-launch: Do not assume error messages have a src element\n    - multiqueue: Fix object reference handling in signal callbacks\n    - netclientclock: Fix memory leak in error paths\n\n- Update to version 1.26.6:\n\n  + Highlighted bugfixes in 1.26.6:\n\n    - analytics GstTensorMeta handling changes (see note below)\n    - closed caption combiner and transcriberbin stability fixes\n    - decklinkvideosrc: fix unrecoverable state after failing to\n      start streaming because device is busy\n    - decodebin3 tag handling improvements\n    - fallbacksrc: Fix sources only being restarted once, as well\n      as some deadlocks and race conditions on shutdown\n    - gtk4paintablesink: Try importing dmabufs withouth DMA_DRM\n      caps\n    - hlsdemux2: Fix parsing of byterange and init map directives\n    - rtpmp4gdepay2: allow only constantduration with neither\n      constantsize nor sizelength set\n    - spotifysrc: update to librespot 0.7 to make work after recent\n      Spotify changes\n    - threadshare: new blocking adapter element for use in front of\n      block elements such as sinks that sync to the clock\n    - threadshare: various other threadshare element fixes and\n      improvements\n    - v4l2: Add support for WVC1 and WMV3\n    - videorate: possible performance improvements when operating\n      in drop-only mode\n    - GstBaseParse fixes\n    - Vulkan video decoder fixes\n    - Fix gst-device-monitor-1.0 tool device-path regression on\n      Windows\n    - Monorepo development environment builds fewer plugins using\n      subprojects by default, those require explicit enablement now\n    - Python bindings: Handle buffer PTS, DTS, duration, offset,\n      and offset-end as unsigned long long (regression fix)\n    - Cerbero: Reduce recipe parallelism in various cases and dump\n      cerbero and recipe versions into datadir during packaging\n    - Various bug fixes, build fixes, memory leak fixes, and other\n      stability and reliability improvements\n\n  + Possibly breaking behavioural changes:\n\n    - Previously it was guaranteed that there is only ever up to\n      one GstTensorMeta per buffer. This is no longer true and code\n      working with GstTensorMeta must be able to handle multiple\n      GstTensorMeta now.\n\n  + gstreamer:\n\n    - baseparse: Try harder to fixate caps based on upstream in\n      default negotiation\n    - gst-discoverer reports 1x1 dimensions for \"valid\" MP4 files\n    - baseparse: don't clear most sticky events after a FLUSH_STOP\n      event\n    - gstreamer: Disable miniobject inline functions for\n      gobject-introspection for non-subprojects too\n    - gstreamer: Make sure to zero-initialize the GValue before\n      G_VALUE_COLLECT_INIT\n    - ptp: Fix a new Rust 1.89 compiler warning on Windows\n    - ptp: Fix new compiler warning with Rust 1.89\n    - Segmentation fault when compiled with\n      \"-ftrivial-auto-var-init=pattern\". Use of unitialized GValue\n\n- Update to version 1.26.5:\n\n  + Highlighted bugfixes:\n\n    - audioconvert: Fix caps negotiation regression when using a\n      mix matrix\n    - cea608overlay, cea708overlay: Accept GPU memory buffers if\n      downstream supports the overlay composition meta\n    - d3d12screencapture source element and device provider fixes\n    - decodebin3: Don't error on an incoming ONVIF metadata stream\n    - uridecodebin3: Fix potential crash when adding URIs to\n      messages, e.g. if no decoder is available\n    - v4l2: Fix memory leak for dynamic resolution change\n    - VA encoder fixes\n    - videorate, imagefreeze: Add support for JPEG XS\n    - Vulkan integration fixes\n    - wasapi2 audio device monitor improvements\n    - threadshare: Many improvements and fixes to the generic\n      threadshare and RTP threadshare elements\n    - rtpbin2 improvements and fixes\n    - gst-device-monitor-1.0 command line tool improvements\n    - Various bug fixes, build fixes, memory leak fixes, and other\n      stability and reliability improvements\n\n  + gstreamer:\n\n    - aggregator: add sub_latency_min to pad queue size\n    - build: Disable C5287 warning on MSVC\n\n- Update to version 1.26.4:\n\n  + Highlighted bugfixes in 1.26.4:\n\n    - adaptivedemux2: Fixed reverse playback\n    - d3d12screencapture: Add support for monitor add/remove in\n      device provider\n    - rtmp2src: various fixes to make it play back AWS medialive\n      streams\n    - rtph265pay: add profile-id, tier-flag, and level-id to output\n      rtp caps\n    - vp9parse: Fix handling of spatial SVC decoding\n    - vtenc: Fix negotiation failure with profile=main-422-10\n    - gtk4paintablesink: Add YCbCr memory texture formats and other\n      improvements\n    - livekit: add room-timeout\n    - mp4mux: add TAI timestamp muxing support\n    - rtpbin2: fix various race conditions, plus other bug fixes\n      and performance improvements\n    - threadshare: add a ts-rtpdtmfsrc element, implement run-time\n      input switching in ts-intersrc\n    - webrtcsink: fix deadlock on error setting remote description\n      and other fixes.\n    - cerbero: WiX installer: fix missing props files in the MSI\n      packages\n    - smaller macOS/iOS package sizes\n    - Various bug fixes, build fixes, memory leak fixes, and other\n      stability and reliability improvements\n\n  + gstreamer:\n\n    - tracers: Fix deadlock in latency tracer\n    - Fix various valgrind/test errors when GST_DEBUG is enabled\n    - More valgrind and test fixes\n    - Various ASAN fixes\n\n- Update to version 1.26.3:\n\n  + Highlighted bugfixes in 1.26.3:\n\n    - Security fix for the H.266 video parser\n    - Fix regression for WAV files with acid chunks\n    - Fix high memory consumption caused by a text handling\n      regression in uridecodebin3 and playbin3\n    - Fix panic on late GOP in fragmented MP4 muxer\n    - Closed caption conversion, rendering and muxing improvements\n    - Decklink video sink preroll frame rendering and clock drift\n      handling fixes\n    - MPEG-TS demuxing and muxing fixes\n    - MP4 muxer fixes for creating very large files with faststart\n      support\n    - New thread-sharing 1:N inter source and sink elements, and a\n      ts-rtpdtmfsrc\n    - New speech synthesis element around ElevenLabs API\n    - RTP H.265 depayloader fixes and improvements, as well as TWCC\n      and GCC congestion control fixes\n    - Seeking improvements in DASH client for streams with gaps\n    - WebRTC sink and source fixes and enhancements, including to\n      LiveKit and WHIP signallers\n    - The macOS osxvideosink now posts navigation messages\n    - QtQML6GL video sink input event handling improvements\n    - Overhaul detection of hardware-accelerated video codecs on\n      Android\n    - Video4Linux capture source fixes and support for BT.2100 PQ\n      and 1:4:5:3 colorimetry\n    - Vulkan buffer upload and memory handling regression fixes\n    - gst-python: fix various regressions introduced in 1.26.2\n    - cerbero: fix text relocation issues on 32-bit Android and fix\n      broken VisualStudio VC templates\n    - packages: ship pbtypes plugin and update openssl to 3.5.0 LTS\n    - Various bug fixes, build fixes, memory leak fixes, and other\n      stability and reliability improvements\n\n  + gstreamer:\n\n    - aggregator: Do not set event seqnum to INVALID\n    - baseparse: test: Fix race on test start\n    - pad: Only remove TAG events on STREAM_START if the stream-id\n      actually changes\n    - utils: Mark times array as static to avoid symbol conflict\n      with the POSIX function\n    - vecdeque: Use correct index type gst_vec_deque_drop_struct()\n","status":"published","published":"2026-03-05T18:13:13Z","modified":"2026-03-23T04:54:22.751192Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"openSUSE-SU-2026:20364-1","title":"Security update for rust-keylime","description":"This update for rust-keylime fixes the following issues:\n\n- Update to version 0.2.8+116:\n- CVE-2026-25727: Update vendored crates to fix a date parser can lead to stack exhaustion in Time. (bsc#1257908)\n","status":"published","published":"2026-03-16T15:31:12Z","modified":"2026-03-23T04:54:51.222394Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"openSUSE-SU-2026:21134-1","title":"Security update for glycin-loaders","description":"This update for glycin-loaders fixes the following issues\n\n- CVE-2025-55159: slab: incorrect bounds check in get_disjoint_mut function can lead to undefined behavior or potential\n  crash due to out-of-bounds access (bsc#1248035).\n- CVE-2025-58160: tracing-subscriber: Tracing log pollution (bsc#1249010).\n","status":"published","published":"2026-06-20T18:27:34Z","modified":"2026-06-30T18:24:44.25903585Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"openSUSE-SU-2026:21560-1","title":"Security update for kak-lsp","description":"This update for kak-lsp fixes the following issues:\n\nChanges in kak-lsp:\n\n- Update to version 21.0.2:\n  * Fix a regression that broke compatibility with Kakoune versions\n    older than 2026.05.21\n  * Add a default configuration for Hare, using hare-lsp\n  * Fix hangs after editing a file without a trailing newline, such\n    as an empty file\n  * Use nixd instead of nil as the default language server for nix\n  * Fix buffer-sync corruption when .editorconfig sets\n    insert_final_newline = false\n- Refresh the vendored registry. Recording the state of the open\n  vendored-crate CVEs against it, none of which this package is\n  affected by:\n  * CVE-2026-25541 (boo#1274502): bytes is 1.12.1, above the 1.11.1\n    fix\n  * CVE-2025-3416 (boo#1242654): the openssl crate is 0.10.81, above\n    the 0.10.72 fix; it was already 0.10.80 before this update\n  * CVE-2025-55159 (boo#1248048): slab is 0.4.12, above the 0.4.11\n    fix; only 0.4.10 was ever affected and this package never\n    shipped it\n\n- Update to version 20.0.0:\n  * v20.0.0\n  * Update changelog\n  * Fix tinymist documentation URL\n  * Fix tinymist preview config key. `previewFeature` only works for the vscode plugin\n  * Encode brackets for file paths\n  * feat: swift/sourcekit-lsp support\n  * Paal �ye-Str�mme Copyright Waiver\n  * Make sure buffer synchronization works even when finaleol is missing\n  * workspace/executeCommand: don't panic on invalid args JSON\n  * servers.kak: update markdown-oxide root markers\n  * Inline lsp-initial-goto-position\n  * Fix function_casts_as_integer warning\n  * lsp-capabilities: remove stale default mappings\n  * changelog new erlang default server\n  * fix(ci/commit-new-release.sh): interpolate version number\n  * Change default language server for erlang\n  * lsp-inlay-hint-apply-*: fix crash when no hints avail\n  * Add inlay hint textedit support\n  * start new cycle\n\n- Update to version 19.0.1:\n  * v19.0.1\n  * Don't print Hover: prefix if there are no diagnostics\n  * Changelog for regression fix\n  * Fix lsp-find-error incorrectly handling --previous flag\n  * ci/commit-new-release.sh: support jj\n  * start new cycle\n\n- Update to version 18.2.0:\n  * v18.2.0\n  * Update changelog\n  * Remove misleading debug log in SessionRenamed hook\n  * Make *diagnostics* buffer one-line-per diagnostics\n  * test/gopls-dynamic-settings.sh: fix for recent gopls\n  * clippy\n  * controller: consume entire request before checking for user errors\n  * Add support vuejs\n  * Fix crash on invalid text edit ranges\n  * Send initializationOptions and workspace/didChangeConfiguration as expected by jdtls\n  * cargo update\n  * Fix type inference errors with deranged 0.4.1\n  * Fix symbol name prefix for breadcrumbs\n  * Work around breaking change in deranged crate\n  * Simplify recursive breadcrumbs calculation\n  * Language-specific SymbolKind rendering\n  * lsp-goto-document-symbol: remove symbol kind suffix\n  * start new cycle\n\n- Update to version 18.1.3:\n  * v18.1.3\n  * Use the right language ID when [language.foo] is in effect\n  * Remove unused line-specs option\n  * Better variable name for code lens line-specs value\n  * lsp-object: don't send documentSymbol to servers that don't support it\n  * Include language server name in stderr logs\n  * Use rust-analyzer from PATH\n  * Work around lsp-rename didChange failing when using window scope\n  * Send texlab-specific requests only to servers that support them\n  * Fix dart language server command\n  * Add kak-lsp server PID to the closing log message\n  * Report more diagnostics information, in multiple lines\n  * Fix regression causing spurious/missing server name in hover\n  * Address clippy lints\n  * Config knob to override magic single-instance setting\n  * Back out \"Add curly underline to DiagnosticError face\"\n  * start new cycle\n\n\n- Update to version 18.1.2:\n  * Silence errors from non-default hooks\n  * Fix languageId for JSX/TSX files\n  * Silence deprecation warning\n  * Add curly underline to DiagnosticError face\n\n- Update to version 18.1.1:\n  * Make crash reporting optional for now\n  * Touch up installation instructions in readme\n  * Make force-exit code paths safer\n  * Extract function\n  * Rework \"Prevent buffer content logic from reading to much\"\n  * Don't send debug log about excessive progress reports to editor\n  * Make test/clangd-invalid-utf8.sh compatible with older clangd\n  * Fix crash when legacy \"language\" config option uses language IDs\n  * Set LAST_CLIENT earlier\n  * test/clangd-invalid-utf8.sh: fix for modern clang\n  * Add biome to CSS and GraphQL\n  * On crash, disable LSP hooks in current buffer\n  * Simplify sentry integration\n  * Work around crash on unsaved files after server restart\n  * Add context to crash report message\n  * Include formatted panic info and backtrace in crash report\n  * Crash reporting via sentry.io\n  * Make the default panic message a little less intimidating\n  * Generalize option change hook parsing code\n  * Back out \"Fix fake textDocument/didOpen for unsaved files\"\n  * Back out \"Make sure to call textDocument/didOpen when lsp_servers is set after BufCreate\"\n  * Prevent buffer content logic from reading to much\n  * Fix crash on \u003cc-c\u003e during -sync command\n  * Make sure to call textDocument/didOpen when lsp_servers is set after BufCreate\n  * Add commented config for tailwindcss-language-server\n  * Fix fake textDocument/didOpen for unsaved files\n  * Stop logging the lsp-show-error call\n  * Fix garbage languageId being sent on lsp-workspace-symbol\n  * Clean up editor command dispatch code\n  * Rename command sender type\n  * Fix corruption applying text edits to non-buffer, non-ASCII files\n  * Separate out function for applying text edits to in-memory data structure\n  * Apply clippy lints\n  * Update unit tests\n  * Consolidate error reporting\n  * Work around missing error on missing code lens after server restart\n  * Type for client name\n  * Rework editor-command sending\n  * Remove most uses of EditorMeta::session\n  * Remove vestiges of multi-session code\n  * Bravely remove obsolete command_fifo, make response_fifo handling more robust\n  * Fix flaky test/gopls-goto-definition.sh\n  * Remove unused function\n  * Add more details to fifo log\n  * Remove unused parameter\n  * Use a separate field for requests pending initialization resp. textDocument/didChange\n  * Fix hang when sync request is used in hook when LSP is disabled\n  * Fix lsp-did-change not being sent for lsp-code-actions-sync\n  * Fix lingering sync state when lsp is disabled\n  * Remove unused lsp-with-option command\n  * Stop printing panic backtrace twice\n  * Add badges for latest release and chat networks\n  * Fix stacktrace being printed on EPIPE, remove redundant error output\n  * Call out feedback/support channels a bit more\n  * Stop linking to the Wiki page for installing servers\n  * Only set javascriptreact/typescriptreact language ID for jsx/tsx files\n\n- Update to version 18.1.0:\n  * Fix mixed-up order in tailwindcss example\n  * Fix bell in modeline not being cleared on ShowMessage notifications\n  * Fix patttern typo\n  * Add markdown-oxide language-server\n  * Add ruby-lsp language-server\n  * Fix stale quoting in lsp-do-send-sync\n  * Add log statements for raw request, handle EWOULDBLOCK/EAGAIN\n  * Use write instead of %val{selection} to send buffer contents\n  * Use a nonblocking fifo instead of pykak-style alternating fifos\n  * Address clippy lint\n  * Extend macOS workarounds to buffer synchronization\n  * Fail early again on missing language.foo.command field\n  * Also use elixir-ls on eex files\n  * Fail startup if session state files already exists\n  * Don't create session state if session is already running\n  * Escalate failure if kak-lsp daemon fails to start\n  * Don't clean up parent of session directories\n  * Do not briefly start kak-lsp on KakEnd if lsp-enable has never been called\n  * Fix typo in lsp-exit\n  * Rectify inconsistent quoting in recommended mappings\n  * Don't block when language servers are slow to exit\n  * Work around hang due to lost fifo on macOS\n  * Restyle --help output\n  * Fix test/clangd-diagnostic-gutter.sh flakiness\n  * Fix test/run not finding python on macOS\n  * Remove bad text edit assertion\n  * Braces in commented out code must match too\n  * The correct validation setting for CSS is `css.validate = true`\n  * Add CSS, HTML and JSON options, add Haskell's static-ls\n  * Workaround macOS waitid() not zeroing si_signo\n  * Fix waitid() being called unnecessarily\n  * Fix formatting spuriously moving cursor with vscode-html-language-server\n  * Fix Rust version\n  * Workaround HTML/CSS language servers not enabling formatting\n  * Workaround HTML/CSS language server crashing due to missing validProperties\n  * Fix crash interpreting text edit without trailing newline\n  * Clean up a debug log\n  * Remove dependency on Rust 1.80\n  * Fix regression causing crash when language server command fails exec()\n  * Don't send SIGTERM to language server, remove obsolete wait()\n  * Simplify sending of initialization options\n  * Fix regression causing hangs on restart\n  * Fix regression causing server configuration to be sent as initialization option\n  * Fix regression causing \"kak -p\" to become a zombie\n  * Remove \"set-option -add\" from most commented default configs\n  * Back out \"lsp-start to wait until existing server has exited\"\n  * Fix race conditions reading kak-lsp PID file\n  * Send SIGTERM, not SIGKILL to shut down inert language server\n  * Speed up language server shutdown\n  * lsp-exit to wait until the session directory is removed\n  * Remove shell calls from async request sending\n  * Drain fifo on exit to unblock Kakoune\n  * Remove unnecssary environment variable\n  * Refactor temporary directory cleanup logic\n  * lsp-start to wait until existing server has exited\n  * Wait for PID file creation after start\n  * Move fifo into a per-session directory\n  * Remove errant semicolon\n  * Remove shell calls for code-actions and highlight-references hooks\n  * Move hook definition out of the way\n  * Stop using temporary file also for textDocument/didChange and textDocument/didOpen\n  * typst: add default configuration\n  * Mohamad Makki Copyright Waiver\n  * Update manual installation instructions for ARM macOS\n\n- Update to version 18.0.3:\n  * Update changelog for release\n  * Disable CI runs for a special \"docs\" branch\n  * Scala Metals: turn off Unicode icons until Kakoune can handle emoji width\n  * Simply use stdout instead of fd 3 for request sending\n  * Remove redundant fifo re-creation\n  * Elide temporary file when writing to fifo\n  * Fix escaping if session name starts with a dash\n  * Move loop-invariant set-option out of the loop\n  * Fix window/showMessageRequest ID deserialization\n  * lsp-disable: unset LSP modeline\n  * Fix eslint workaround\n  * Fix crash when \"language\" key is used in legacy kak-lsp.toml\n  * julia lsp configuration: move root_globs\n  * minor: fix typo in julia lsp config\n  * cargo update\n  * cargo clippy\n  * Fix crash in lsp-selection-range\n  * Show error instead of crashing if lsp_servers root is not an absolute path\n  * Block LSP requests after KakEnd to work around delay on bad config\n  * lsp-do-send: also block SIGINT once we have acquired the fifo\n  * README: update \"Pre-built binaries\" section\n  * Fix state transition when lsp-enable{,-window} are accidentally mixed\n  * Remove shell call from lsp-if-no-servers\n  * Remove misleading \"set-option -add lsp_server\" from default hooks\n  * lsp-object: fix crash on invalid param, improve docs\n\n- Update to version 18.0.2:\n  * v18.0.2\n  * README: link to troubleshooting section\n  * Fix stale comment in test\n  * Update changelog\n  * Show panics in an info box\n  * Generate a core dump when crashing via a Rust panic\n  * lsp-definition: explain fallback in error message\n  * Fix crash in lsp-highlight-references\n  * Log kak-lsp daemon PID on startup\n  * Removed redundant error check\n","status":"published","published":"2026-08-10T16:06:46Z","modified":"2026-08-12T18:23:42.677936968Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"openSUSE-SU-2026:21584-1","title":"Security update for git-cliff","description":"This update for git-cliff fixes the following issues:\n\nChanges in git-cliff:\n\n- Update to version 2.13.1:\n  * Support more configuration file locations\n  * Add per-commit statistics\n  * Expose determined bump type in release context\n  * Add configurable commit processing order\n  * Add environment variable for offline execution\n  * Migrate logging to tracing\n  * Add caching where applicable\n- CVE-2026-25541: bytes: integer overflow in 'BytesMut:reserve' can\n  lead to undefined behavior and crashes (boo#1274523)\n\n- Update to version 2.12.0:\n  * Add offline flag\n  * Add --skip-tags cli argument\n  * Implement commit processing summary\n  * Bug Fixes\n- includes changes from 2.11.0:\n  * Support failing on unmatched commits\n  * Add support for azure devops\n  * Improve repository/directory path resolution\n  * Add split_regex, replace_regex, find_regex filters\n  * Bug Fixes\n- includes changes from 2.10.1:\n  * Add 'integrations' feature flag for enabling all integrations\n  * Bug Fixes\n  * CVE-2025-55159: lab: incorrect bounds check in get_disjoint_mut\n    function can lead to undefined behavior or potential crash due\n    to out-of-bounds access (boo#1248065)\n\n- Update to version 2.10.0:\n  * (config) Support using include and exclude paths in the config (#1173) - (7c2f922)\n  * (parser) Support regex matching on JSON arrays with scalar elements (#1163) - (dc458ea)\n  * (template) Support adding commit statistics to the changelog (#1151) - (05a50d7)\n  * (config) [breaking] Use empty header and footer as default (#1161) (#1172) - (3e9311e)\n  * (config) Check if commit.footers is defined in detailed example (#1170) - (078545f)\n  * (fixtures) Update expected.md after config change (#1176) - (76d3e81)\n  * (generation) Ensure skip_tags condition is evaluated first (#1190) - (318be66)\n  * (repo) Use the correct order while diffing paths (#1188) - (ff6c310)\n  * (ci) Apply security best practices (#1180) - (a32deca)\n  * (config) Implement FromStr instead of Config::parse_from_str() (#1185) - (692345e)\n  * (test) Standardize unit tests for commit module (#1147) - (0446d6a)\n  * (context) Add example usage for statistics (#1162) - (4f7379a)\n  * (quickstart) Remove repetitive words (#1200) - (434f9ee)\n  * (readme) Fix twitter badge (#1164) - (68bd85e)\n  * (readme) Polish badges (#1159) - (941cc2b)\n  * (remote) Fix inconsistency in remote integration documentation (#1165) - (deb29dc)\n  * (website) Add highlights for 2.10.0 (#1225) - (a3fe8c9)\n  * (website) Add installation instructions for gentoo-linux (#1203) - (07fe6bf)\n  * (formatting) Use spaces instead of tabs (#1184) - (0027300)\n  * (fixture) Add test fixture for overriding the conventional scope (#1166) - (cb84a08)\n  * (build) Bump MSRV to 1.85.1 - (d8279d4)\n  * (cd) Use macos-15 runner - (c156fc5)\n  * (cd) Re-enable sccache for maturin - (871c3c9)\n  * (crate) Remove Rust nightly requirement - (4f3e5af)\n  * (fixture) Update test-regex-json-array fixture (#1178) - (95f4056)\n  * (format) Format module imports for readability (#1183) - (6db7d49)\n  * (git) Add .git-blame-ignore-revs - (5b64131)\n  * (npm) Bump git-cliff to 2.9.1 (#1156) - (e13b158)\n  * (website) Update the node version - (566c2a1)\n  * Check if commit.footers is defined in detailed example (#1170) (078545f)\n  * (breaking) Use empty header and footer as default (#1161) (#1172) (3e9311e)\n  * Update expected.md after config change (#1176) (76d3e81)\n  * Use the correct order while diffing paths (#1188) (ff6c310)\n  * Ensure skip_tags condition is evaluated first (#1190) (318be66)\n  * Polish badges (#1159) (941cc2b)\n  * Fix twitter badge (#1164) (68bd85e)\n  * Fix inconsistency in remote integration documentation (#1165) (deb29dc)\n  * Add example usage for statistics (#1162) (4f7379a)\n  * Remove repetitive words (#1200) (434f9ee)\n  * Add installation instructions for gentoo-linux (#1203) (07fe6bf)\n  * Add highlights for 2.10.0 (#1225) (a3fe8c9)\n  * Support regex matching on JSON arrays with scalar elements (#1163) (dc458ea)\n  * Support using include and exclude paths in the config (#1173) (7c2f922)\n  * Support adding commit statistics to the changelog (#1151) (05a50d7)\n  * Bump git-cliff to 2.9.1 (#1156) (e13b158)\n  * Re-enable sccache for maturin (871c3c9)\n  * Update test-regex-json-array fixture (#1178) (95f4056)\n  * Format module imports for readability (#1183) (6db7d49)\n  * Use macos-15 runner (c156fc5)\n  * Update the node version (566c2a1)\n  * Remove Rust nightly requirement (4f3e5af)\n  * Bump MSRV to 1.85.1 (d8279d4)\n  * Add .git-blame-ignore-revs (5b64131)\n  * Standardize unit tests for commit module (#1147) (0446d6a)\n  * Resolve mismatched lifetime syntax warnings (#1167) (9970402)\n  * Implement FromStr instead of Config::parse_from_str() (#1185) (692345e)\n  * Apply security best practices (#1180) (a32deca)\n  * Use spaces instead of tabs (#1184) (0027300)\n  * Add test fixture for overriding the conventional scope (#1166) (cb84a08)\n\n- Update to version 2.9.1:\n  * CI/CD fixes only\n\n- Update to version 2.9.0:\n  * chore(release): prepare for v2.9.0\n  * docs(website): add highlights for 2.9.0 (#1153)\n  * chore(deps-dev): bump typescript in /website in the patch group (#1139)\n  * chore(docs): fix some typos (#1149)\n  * fix(template): correctly serialize JSON for the commit fields (#1145)\n  * docs(security): extend security policy (#1142)\n  * chore(deps): bump the minor group in /website with 2 updates (#1116)\n  * refactor(lint): apply clippy suggestions\n  * feat(context): add release commit range (#1138)\n  * fix(submodules): fix submodules handling when using custom range (#1136)\n  * docs(config): fix typo on commit.links (#1132)\n  * chore(deps): upgrade dependencies (#1129)\n  * chore(project): migrate to Rust 2024 edition (#1128)\n  * feat(changelog): support recursing into submodules (#1082)\n  * feat(remote): fetch commits from non-default branches using remotes (#1086)\n  * feat(git): support disabling sorting commits topologically (#804) (#1121)\n  * refactor(config): initialize config structs with default values (#1090)\n  * chore(dependabot): make dependency updates less noisy\n  * chore(dependabot): check dependency updates weekly\n  * fix(bump): check the next version against tag_pattern regex (#1070)\n  * feat(config): support configuring with a remote URL (#1083)\n  * fix(fixtures): evaluate the rc of git-cliff correctly (#1104)\n  * fix(bump): accept lowercase values for bump_type config (#1101)\n  * docs(readme): add blog posts from the community (#1102)\n  * fix(fixtures): use the correct syntax while checking fixture results (#1099)\n  * docs(website): remove references of tj-actions (#1097)\n  * feat(config): add `require_conventional` option (#1061)\n  * docs(release): fix Docker Hub URL\n  * refactor(lint): use IOError::other (#1074)\n  * doc(config): update comments for all configuration options (#1057)\n  * docs(quickstart): clarify git-cliff command (#1051)\n  * fix(git): handle worktrees while retrieving the path of repository (#1054)\n  * chore(npm): update yarn.lock\n  * fix(remote): fix detection of GitLab merge request sha if commits were squashed (#1043)\n  * fix(deps): make glob dependency mandatory (#1035)\n\n- Update to version 2.8.0:\n  * cli: Support initializing config with a custom filename\n  * config: Discover the configuration file when run in a sub directory\n  * git: Improve the set commit range error\n  * monorepo: Automatically set include-path for current directory\n  * remote: Support enabling native TLS\n  * repo: Allow running from sub directories\n  * config: Allow environment overwrites when using builtin config\n  * fixtures: Update the arguments for custom GitLab API fixture test\n  * monorepo: Do not set include-path if workdir is set\n  * remote: Fix detection of GitLab merge request sha\n  * lib: Add changelog modifier callback to run function\n  * lint: Use a shared lint config for the workspace\n  * lint: Apply clippy suggestions\n  * docker: Fix typo in comment\n  * highlights: Add link to the Nix flake\n  * jujutsu: Update links to the upstream documentation\n  * lib: Allow doc lint\n  * license: Update copyright years\n  * tips: Extend the merge commit filter example\n  * website: Add highlights for 2.8.0\n  * fixture: Add fixture for include-path\n  * build: Bump MSRV to 1.83.0\n  * lint: Allow false positive lint\n\n- Update to version 2.7.0:\n  * refactor(clippy): apply clippy suggestions\n  * chore(deps): bump dependencies\n  * chore(integration): remove experimental feature disclaimer\n  * feat(config): allow overriding the remote API URL via config\n  * docs(git): improve docs for commit_preprocessors and commit_parsers\n  * feat(jujutsu): add jujustu support\n  * perf(test): don't create regex inside a loop\n  * chore(log): add trace log about which command is being run\n  * fix(remote): preserve first time contributors\n  * test(git): find upstream remote when using ssh\n  * docs(readme): add blog post about git-cliff\n  * chore(config): add the 'other' parser to the default config\n  * fix(changelog): fix missing commit fields in context\n  * refactor(clippy): apply clippy suggestions\n  * test(repo): expand unit tests of the repo module\n  * fix(changelog): include the root commit when `--latest` is used with one tag\n  * chore(deps): bump clap from 4.5.18 to 4.5.19\n  * feat(args): add color to the help text\n  * chore(release): prepare for v2.6.1\n  * refactor(clippy): apply doc_markdown and ignored_unit_patterns lint\n  * chore(fixtures): build binaries using dev profile\n  * refactor(clippy): apply if_not_else lint\n  * fix(remote): avoid setting multiple remotes\n  * chore(deps): bump thiserror from 1.0.63 to 1.0.64\n  * refactor(clippy): apply assigning_clones lint\n  * refactor(clippy): apply single_match_else lint\n  * refactor(clippy): apply needless_pass_by_value lint\n  * chore(release): prepare for v2.6.0\n  * feat(config): add changelog.render_always option\n  * chore(deps): bump dependencies\n  * fix(changelog): do not change the tag date if tag already exists\n  * feat(config): allow configuring output file from config\n  * docs(args): fix copy-paste mistake where gitea mentioned gitlab\n  * fix(commit): trim the trailing newline for git2 commits\n  * fix(bump): suppress template warning when `--bumped-version` is used\n  * refactor(clippy): apply explicit_iter_loop lint\n  * refactor(clippy): apply manual_is_variant_and lint\n  * chore(deps): bump clap_complete from 4.5.23 to 4.5.28\n  * chore(deps-dev): bump typescript from 5.5.4 to 5.6.2 in /website in the minor group\n  * chore(deps): bump pretty_assertions from 1.4.0 to 1.4.1\n  * fix(changelog): correctly set the tag message for the latest release\n  * refactor(clippy): apply case_sensitive_file_extension_comparisons lint\n  * refactor(clippy): apply clippy suggestions\n  * refactor(clippy): apply option_as_ref_cloned lint\n  * refactor(template)!: add name parameter to the constructor\n  * fix(core): avoid the unnecessary loop when no remote feature is activated\n  * feat(core): add `remote` to commit and deprecate fields\n  * refactor(clippy): apply semicolon_if_nothing_returned clippy lint\n  * refactor(clippy): apply unnested_or_patterns clippy lint\n  * docs(contributing): mention fetching the tags for running tests successfully\n  * fix(args): support using use_branch_tags from both config and args\n  * feat(changelog): support generating changelog for different branches\n  * chore(examples): improve example templates\n  * chore(lib): fix typos in code comments\n  * chore(deps): bump prism-react-renderer from 2.3.1 to 2.4.0 in /website in the minor group\n  * fix(template): resolve parsing issues with `raw`/`endraw` in Jinja\n  * fix(changelog): don't change the context when provided via `--from-context`\n","status":"published","published":"2026-08-14T15:43:56Z","modified":"2026-08-16T18:23:36.810533351Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"openSUSE-SU-2026:21605-1","title":"Security update for forgejo-cli","description":"This update for forgejo-cli fixes the following issues:\n\nChanges in forgejo-cli:\n\n- Update vendored bytes crate to 1.12.1\n  * CVE-2026-25541: Fixed an integer overflow in BytesMut::reserve that could\n    corrupt the tracked capacity and lead to out-of-bounds slices (boo#1274529).\n\n- update to 0.6.0:\n  * Localization!\n    - forgejo-cli has gained localization support!\n      You can now use it in your preferred language, just like\n      Forgejo itself.\n      Currently de-DE and zh-Hans are included, with several more\n      being in-progress.\n      See the project on Codeberg Translate if you want to help out\n      with any languages you know!\n      https://translate.codeberg.org/projects/forgejo-cli/forgejo-cli/\n  * Additions\n    - (!586) fj issue/pr view assignees to see who is assigned to\n      an issue or pull request\n    - (!582) --avatar/--unset-avatar options on fj repo edit\n    - (!554) fj repo star-status to check if you've starred a repo\n    - (!547) --cwd option to set the working directory a command is\n      run in\n    - (!533, !561) Commands to watch and unwatch repos\n    - (!462) Resolve SSH host names from SSH config\n    - (!279, !464, !472, !489, !491, !513, !594) Localization\n    - Added fj auth login support for the following instances:\n      - v16.next.forgejo.org\n      - v17.next.forgejo.org\n    - Removed fj auth login support for the following instances\n      that have shut down:\n      - v7.next.forgejo.org\n      - v12.next.forgejo.org\n  * Changes\n    - (!535) Added an error message when fj auth login fails to\n      open the browser\n    - (!523) fj auth add-key was renamed to fj auth add-token. An\n      alias still exists to add-key, so this isn't a breaking\n      change.\n    - (!514) The --host flag can now be anywhere in the command,\n      instead of only the beginning\n    - (!504) fj auth add-token no longer takes a username argument.\n  * Fixes\n    - (!579) Fixed fj issue unassign incorrectly unassigning\n      everyone except the intended users\n    - (!569) Fixed display of labels failing when a label is marked\n      as exclusive but does not contain a slash\n    - (!542) Fixed parsing of SSH shorthand urls\n    - (!510) Fixed fj pr checkout failing when the instance URL\n      contained a port\n    - (!437) Fixed incorrect parsing of activity info\n  * Other\n    - (!573) Use rust 2024 edition\n    - (!560) Simplify determining repo owner\n    - (!531) Fix clippy warnings\n    - (!527) Remove unused dependencies, narrow tokio features\n    - (!526) Replace crossterm with terminal_size\n    - (!520) Optimize cargo release profile\n    - (!469) Fix typo\n    - (!449) Restricted file permissions at creation time\n    - (!443) Add oneline helptext to 'repo migrate' command\n\n- update to 0.5.0:\n  * Additions\n    - (!334) Support for managing labels on issues and repos.\n    - (!349) repo edit and repo units for modifying settings on a\n      repo and repo units.\n    - (!373) Use the needed CLI flags for more editors when opening\n      them.\n    - (!385) Use the editor defined in git's core.editor config\n      option by default (falling back to $EDITOR if it is not set).\n    - (!414) Add commands to assign and unassign users to issues\n      and PRs.\n    - (!415) Support all README files in fj repo readme, regardless\n      of case or extension.\n    - (!416) Add the option to choose what repo to own the new repo\n      to fj repo migrate.\n    - (!419) Show a warning when viewing an archived repo.\n    - (!420) Add a notice about git push --force not being\n      supported on AGit PRs.\n    - Added fj auth login support for the following instances:\n      - v15.next.forgejo.org\n      - codefloe.com\n  * Fixes\n    - (!393) Don't include pull requests in fj issues search.\n    - (!407) Guarantee opening the browser in fj auth login doesn't\n      block.\n    - (!417) Prevent incorrectly reusing the refresh token when\n      refreshing OAuth tokens.\n  * Other\n    - (!278) Improved \"no repo info\" error message.\n    - (!403) Build aarch64 artifacts for new releases.\n\n- update to 0.4.1:\n  * Fixes\n    - (!368) Generate the correct PKCE challenge verifier. This was\n      preventing fj auth login from succeeding.\n\n- Update to version 0.4.0:\n  * Support for issue \u0026 pull request templates with fj issue/pr create\n    --template\n  * fj pr create --autofill, which will automatically populate the PR's title\n    and body from the commit(s)\n  * fj user key and fj user gpg commands for managing uploaded SSH and GPG keys\n  * fj user repos --page, to select the page of results to view\n  * fj issue/pr create/comment --body-from-file to use the contents of a file\n    as the body\n  * --identity-file/-I flag for selecting the SSH identity to use\n  * fj tag to manage git tags\n  * fj issue search --state all\n  * --remote \u0026 --repo flags can now be at the end of the command with the rest\n    of the flags\n\n- update to 0.3.0:\n  * Additions\n    - Added fj completion to generate completion scripts for various\n      shells\n    - Added fj org for Organization commands.\n    - Added fj actions for Forgejo Actions-related commands (thank\n      you, @LordMZTE !)\n    - OAuth client IDs for fj auth login can now be customized.\n    See the wiki for more on the new features.\n\thttps://codeberg.org/Cyborus/forgejo-cli/wiki/Organizations\n  * Fixes\n    - Keys file now has proper file permissions\n    - Fixed incorrect help commands (thank you, @0ko !)\n    - Always set user agent in requests\n\n- update to 0.2.0:\n  * Additions\n    - pr create and issue create now have a --web flag that opens\n      the creation page in your browser instead of creating it on\n      the terminal.\n    - pr --agit will create a pull request with agit flow, so you\n      don't need to fork the repository.\n    - pr status --wait will only exits once all PR checks finish.\n    - repo migrate to migrate/mirror repositories from other hosts.\n    - repo readme to print a repository's readme to the terminal.\n    - version --verbose prints extra info useful for debugging\n  * Fixes\n    - Public endpoints can now be accessed without authenticating\n    - The API will be accessed via the http url even when it\n      differs from the ssh url and the local remote points to the\n      ssh url.\n    - browse commands will no long hang the terminal\n    - Local repos will now be found even when in a subdirectory\n    - SSH urls in repo remotes will now be parsed correctly\n    - Improved pull request detection\n","status":"published","published":"2026-08-18T16:51:08Z","modified":"2026-08-21T09:15:09.047143705Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"RUSTSEC-2025-0047","title":"Out-of-bounds access in `get_disjoint_mut` due to incorrect bounds check","description":"## Impact\nThe `get_disjoint_mut` method in slab v0.4.10 incorrectly checked if indices were within the slab's capacity instead of its length, allowing access to uninitialized memory. This could lead to undefined behavior or potential crashes.\n\n## Patches\nThis has been fixed in slab v0.4.11.\n\n## Workarounds\nAvoid using `get_disjoint_mut` with indices that might be beyond the slab's actual length, or upgrade to v0.4.11 or later.\n\n## References\n* [https://github.com/tokio-rs/slab/pull/152](https://github.com/tokio-rs/slab/pull/152)","status":"published","published":"2025-08-12T12:00:00Z","modified":"2026-10-12T18:00:07.409780135Z","updated_at":"2026-11-02T15:53:39.971022Z"},{"id":"SUSE-RU-2025:4131-1","title":"Recommended update for suse-migration-sle16-activation, SLES16-Migration, SLES16-SAP_Migration, suse-migration-services, suse-migration-rpm, wicked2nm, image-janitor","description":"This update for suse-migration-sle16-activation, SLES16-Migration, SLES16-SAP_Migration, suse-migration-services, suse-migration-rpm, wicked2nm, image-janitor fixes the following issues:\n\nChanges for suse-migration-sle16-activation:\n\n- Simplify interface naming by disabling predictable names at boot\n- shellcheck heavily complained\n- check migration target before testing for architecture version\n- Create systemd.link files for virtual VMware/Hyper-V NICs\n- Add changes for newest wicked2nm\n- Activation packages can no longer be noarch\n- Architecture check before allowing migration to be activated\n- Add missing pre snapshot setup to run_migration\n- Add wicked2nm network migration\n- Setup ExclusiveArch for activation packages\n- Make activation package require by provides tag\n- Fix product related requirement settings\n\nChanges for SLES16-Migration:\n\n- Added .ssh directory for migration user\n- Add etc/motd overlay file\n  Print message how to show migration progress information\n- Fix build on more architectures\n- Initial changelog\n    \nChanges for SLES16-SAP_Migration:\n\n- Support wicked2nm migration\n- Migration live image for SLES4SAP 15 to 16\n\nChanges for suse-migration-services:\n\n- Set systemd offline for Zypper in chroot mode\n- Fix apparmor install procedure\n- Fixed azuremetadata device lookup\n- Use of f-strings not allowed in the DMS\n- Simplify interface naming by disabling predictable names at boot\n- Fixed test_check_lsm_migration unit test\n- Fix setup_host_network_test by mocking os.makedirs\n- wicked2nm: log network state on nm-online failure\n- Fixed LSM pre checks to be more robust\n- shellcheck heavily complained\n- Do not evaluate wicked2nm output in precheck\n- Fix unit test for lsm check\n- prechecks/lsm.py: remove _apparmor_analyze_profiles()\n- LSM migration check for AppArmor -\u003e SELinux\n- Improve pre-check message\n- Fix MinSLEVersion value depending on target\n- reduce package set on migration image\n- Fixed behavior of wicked2m pre check\n- implementation of sshd root login pre-check\n- Fixed selinux to apparmor migration\n- Fixed reading of migration config for target class\n- Add recursion guard to MigrationConfig::_merge_config_dicts\n- shrink migration image\n- container/sle16/config.sh\n- sle16/config.sh - use dropin for s390 migration-config\n- doc: fix indentation\n- check for migration target by matching ISO file name\n- config: introduce dropin dir migration-config.d/\n- Apply SLE16 live image setup to container setup\n- bind mount only required subdirectories under /run into chroot\n- Add missing package requirement\n- check migration target before testing for architecture version\n- setup_host_network: simplify code - use os.makedirs()\n- Create systemd.link files for virtual VMware/Hyper-V NIC\n- Preserve systemd.link files from /etc/systemd/network/   \n- Add changes for the newest wicked2nm\n- Ensure wicked2nm is a dependency of pre-checks for SLE 16 migration\n- Activation packages can no longer be noarch\n- Fix update of image .changes files\n- Architecture check before allowing migration to be activated\n- Improve error logs when wicked2nm fails\n- Include image changelog to version bump\n- Ensure wicked2nm migration is always running, despite warnings\n- Fix: add --no-recommends on patterns-base-selinux installation\n- Update suse-migration-services for container use\n- Update SLE16 migration container\n- Update SAP live migration image\n- Add missing pre snapshot setup to run_migration\n- Follow up fix for the wicked to nm migration\n- Add wicked2nm network migration\n- Add glob support to preserve_files\n- Setup ExclusiveArch for activation packages\n- Build sles4sap migration for cloud on x86_64 only\n- Do not build sles4sap migration on s390x   \n- Use systemctl kexec\n- Fix: return the correct kernel path based on machine type\n- Fixed glob pattern match for package name\n- Remove menitoning of SLES 12-SP4\n- Make activation package require by provides tag\n- Added SLES16-SAP_Migration live image\n- Do not use list[str] type hint\n- Fix error evaluation from offline_migrations API\n- Fix logging from non unit files\n- Fix product related requirement settings\n- Repos for migration image must be in kiwi\n- Added .ssh to migration user for SAP 15 live image\n- Added SLES15-SAP_Migration Makefile target\n- Add proper release package for SLE16 migration\n- Fix typo in service name\n- Drop obsolete check for resolv.conf\n- Fix migration user home dir setup for SLE16\n- Update README_QA.rst\n- test: split unit test for setup_name_resolver\n- Install patterns-base-selinux for Apparmor migration\n- Ensure the rebuild counter is not stripped from the rpm\n- Exit silently if no migration iso is found\n- Ensure rpmlintrc file is part of suse-migration-services SRPM\n- Ignore fixup! entries when generating changelog\n- Increase python test matrix\n- Remove redundanct requires on itself\n- Fix ordering of pre-checks and actual migration\n- Add SLES15-Migration target to Makefile\n- Fix suse-migration-console-log service\n- Fix typo in REA- Activate only connections if present in the current system\n- Improve error output, exit codes and add flag to disable user hints\n- Add support for autoip-fallback\n- Issue only a info when dhcp.update is non default \n- Add ipv4_static broadcast \n- Apply dhcp settings to mirror wicked client id \n- Fix test.sh, fail if migration succeed but expect fail \n- Fix sysctl handling \n- Avoid cloning in parsing of route \n- Fix continue migration to show all warnings beforehand \n- Improve warning messages - show interface, element names \n- Remove unwrap in route parsing \n- bump slab from 0.4.10 to 0.4.11 to address CVE-2025-55159 (bsc#1248010)\n- Fix netconfig handling with proper priority setting\n- Add ovs support\n- Use agama-network instead of agama-(lib|server)\n- Only activate connections marked with autostart\n- Give hint in error message how to ignore warnings\n- Update README.md with updated installation and usage infos\n- Add support for Leap 15\n- Remove BuildRequires that are no longer necessary due to the agama-network switch.\n- The agama-network switch also removes the vulnerable and\n  unmaintained 'users' crate from the dependencies. (bsc#1244188)DME_QA\n- Fix: split name resolver setup into its own service\n- Fix: set path according to current arch in grub.d/99_migration\n- Add support to enable single rpm transaction for upgrade\n- enable suse-migration-ha.service in the migration image\n- Migration for high availability extension\n- RPM wrapper fixes\n- Cleanup secfile to follow python singlespec policy\n- Support product specifier in ISO name\n- Ensure sle16 images can build on all supported platforms\n- Use name pattern compatible to suse-migration-rpm\n- Fix SLE15 migration images\n- SAP product should migrate to 15 SP4\n- Add SLES15-SAP-Migration\n- Bump target to SLE15 SP7\n- Update bumpversion config\n  Include sle16 container build to version bump\n- Handle selinux boot option when using kexec\n- Ensure migration to SLES16 uses selinux, not apparmor\n- improve os-release parsing\n- Ensure SLES16 is also detected in SCC precheck\n- Add high availablity extension check\n- Fix package names for python packages on SLE16\n- Relax on the shim-install call\n- Fixup package name for SLE16 and SLE16 container\n- Fix changelog references for activation packages\n- Add product migration check\n    \nChanges for suse-migration-rpm:\n\n- Fix MinSLEVersion value depending on target\n- Add product requirement according to image name.\n- Exit silently if no migration iso is found. \n- Add build and perl(Date::Parse) to ensure we can append changelog entries to generated package.\n\nChanges for wicked2nm:\n    \n- Activate only connections if present in the current system\n- Improve error output, exit codes and add flag to disable user hints\n- Add support for autoip-fallback\n- Issue only a info when dhcp.update is non default \n- Add ipv4_static broadcast \n- Apply dhcp settings to mirror wicked client id \n- Fix test.sh, fail if migration succeed but expect fail \n- Fix sysctl handling \n- Avoid cloning in parsing of route \n- Fix continue migration to show all warnings beforehand \n- Improve warning messages - show interface, element names \n- Remove unwrap in route parsing \n- bump slab from 0.4.10 to 0.4.11 to address CVE-2025-55159 (bsc#1248010)\n- Fix netconfig handling with proper priority setting\n- Add ovs support\n- Use agama-network instead of agama-(lib|server)\n- Only activate connections marked with autostart\n- Give hint in error message how to ignore warnings\n- Update README.md with updated installation and usage infos\n- Add support for Leap 15\n- Remove BuildRequires that are no longer necessary due to the agama-network switch.\n- The agama-network switch also removes the vulnerable and\n  unmaintained 'users' crate from the dependencies. (bsc#1244188)\n    \nChages for image-janitor:\n- Fix packaging (add doc, license)\n- Release 0.2.0 with configuration files packaged\n- Initial packag\n  ","status":"published","published":"2025-11-18T15:56:53Z","modified":"2026-02-04T02:44:06.77344Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-SU-2025:02957-1","title":"Security update for rust-keylime","description":"This update for rust-keylime fixes the following issues:\n\n- Update slab to version 0.4.11:\n  * CVE-2025-55159: Fixed incorrect bounds check in get_disjoint_mut function (bsc#1248006)\n\n- Update to version 0.2.8+12:\n  * build(deps): bump actions/checkout from 4 to 5\n  * build(deps): bump cfg-if from 1.0.0 to 1.0.1\n  * build(deps): bump openssl from 0.10.72 to 0.10.73\n  * build(deps): bump clap from 4.5.39 to 4.5.45\n  * build(deps): bump pest from 2.8.0 to 2.8.1\n  * Fix clippy warnings\n  * Use verifier-provided interval for continuous attestation timing\n  * Add meta object with seconds_to_next_attestation to evidence response\n  * Fix boot time retrieval\n  * Fix IMA log format (it must be ['text/plain']) (#1073)\n  * Remove unnecessary configuration fields\n  * cargo: Bump retry-policies to version 0.4.0\n","status":"published","published":"2025-08-22T07:56:12Z","modified":"2026-02-04T03:55:09.980367Z","updated_at":"2026-11-02T15:53:57.111474Z"},{"id":"SUSE-SU-2025:02961-1","title":"Security update for rust-keylime","description":"This update for rust-keylime fixes the following issues:\n\n- Update slab to version 0.4.11:\n  * CVE-2025-55159: Fixed incorrect bounds check in get_disjoint_mut function (bsc#1248006)\n\n- Update to version 0.2.8+12:\n  * build(deps): bump actions/checkout from 4 to 5\n  * build(deps): bump cfg-if from 1.0.0 to 1.0.1\n  * build(deps): bump openssl from 0.10.72 to 0.10.73\n  * build(deps): bump clap from 4.5.39 to 4.5.45\n  * build(deps): bump pest from 2.8.0 to 2.8.1\n  * Fix clippy warnings\n  * Use verifier-provided interval for continuous attestation timing\n  * Add meta object with seconds_to_next_attestation to evidence response\n  * Fix boot time retrieval\n  * Fix IMA log format (it must be ['text/plain']) (#1073)\n  * Remove unnecessary configuration fields\n  * cargo: Bump retry-policies to version 0.4.0\n","status":"published","published":"2025-08-22T10:07:35Z","modified":"2026-03-23T04:46:55.916054Z","updated_at":"2026-11-02T15:53:57.111474Z"},{"id":"SUSE-SU-2025:02962-1","title":"Security update for rust-keylime","description":"This update for rust-keylime fixes the following issues:\n\n- Update slab to version 0.4.11:\n  * CVE-2025-55159: Fixed incorrect bounds check in get_disjoint_mut function (bsc#1248006)\n\n- Update to version 0.2.8+12:\n  * build(deps): bump actions/checkout from 4 to 5\n  * build(deps): bump cfg-if from 1.0.0 to 1.0.1\n  * build(deps): bump openssl from 0.10.72 to 0.10.73\n  * build(deps): bump clap from 4.5.39 to 4.5.45\n  * build(deps): bump pest from 2.8.0 to 2.8.1\n  * Fix clippy warnings\n  * Use verifier-provided interval for continuous attestation timing\n  * Add meta object with seconds_to_next_attestation to evidence response\n  * Fix boot time retrieval\n  * Fix IMA log format (it must be ['text/plain']) (#1073)\n  * Remove unnecessary configuration fields\n  * cargo: Bump retry-policies to version 0.4.0\n","status":"published","published":"2025-08-22T12:50:26Z","modified":"2026-03-23T04:47:55.058429Z","updated_at":"2026-11-02T15:53:57.111474Z"},{"id":"SUSE-SU-2025:20717-1","title":"Security update for rust-keylime","description":"This update for rust-keylime fixes the following issues:\n\n- Update vendored crate slab to version 0.4.11\n  * CVE-2025-55159: Fixed incorrect bounds check in get_disjoint_mut function \n    leading to undefined behavior or potential crash due to out-of-bounds \n    access (bsc#1248006)\n\n- Update to version 0.2.8+12:\n  * build(deps): bump actions/checkout from 4 to 5\n  * build(deps): bump cfg-if from 1.0.0 to 1.0.1\n  * build(deps): bump openssl from 0.10.72 to 0.10.73\n  * build(deps): bump clap from 4.5.39 to 4.5.45\n  * build(deps): bump pest from 2.8.0 to 2.8.1\n  * Fix clippy warnings\n  * Use verifier-provided interval for continuous attestation timing\n  * Add meta object with seconds_to_next_attestation to evidence response\n  * Fix boot time retrieval\n  * Fix IMA log format (it must be ['text/plain']) (#1073)\n  * Remove unnecessary configuration fields\n  * cargo: Bump retry-policies to version 0.4.0\n\n- Update vendored crate shlex to version 1.3.0\n  * CVE-2024-58266: Fixed command injection (bsc#1247193) \n\n- Update to version 0.2.7+141:\n  * service: Use WantedBy=multi-user.target\n  * rpm: Add subpackage for push-attestation agent\n  * push-model: implement continuous attestation with configurable intervals\n  * Retry registration forever in the state machine\n  * Add Verifier URL to configuration\n  * Align exp.backoff to current configuration format\n  * Increase coverage of state machine (using Context)\n  * Increase coverage of struct_filler.rs\n  * Groom code (remove dead code)\n  * Fix exponential backoff (10secs, 4xx accepted)\n  * test: Add documentation test to tests/run.sh\n  * tpm: Avoid running code example during documentation tests\n  * state_machine: Always start the agent from the Unregistered state\n  * Add fixes for the URL construction\n  * Refactor evidences collection in push attestation agent\n  * push-model: refactor attestation logic into a state machine\n  * Fix body sending by allowing serializing strings (#1057)\n  * Log ResilientClient errors/response status codes (#1055)\n  * Add AK signing scheme and hash algorithm to negotiation\n  * tpm: Add method to extract signing scheme and hash algorithm from AK\n  * Allow custom content-type/accept headers\n  * Integrate exponential backoff to registration (#1052)\n  * keylime/structures: Rename ShaValues to PcrBanks\n  * Add resilient_client for exponential backoff (#1048)\n\n- Update vendored crate openssl 0.10.73:\n  * CVE-2025-3416: Fixed Use-After-Free in Md::fetch and Cipher::fetch (bsc#1242623) \n\n- Update to version 0.2.7+117:\n  * Increase coverage in evidence handling structure\n  * Add Capabilities Negotiations resp. missing fields\n  * Fix UEFI test to check file access in all cases\n  * context_info_handler: Do not assume /var/lib/keylime exists\n  * Fix clippy warnings about uninlined format arguments\n  * attestation: Allow unwrap() in tests\n  * Increase coverage (groom code, extend unit tests)\n  * Include IMA/UEFI logs in Evidence Handling request\n  * Include method to get all IMA entries as string\n  * Send correct list of pcr banks and sign algorithms\n  * Try to fix TPM tests related issues\n  * Define attestation perform asynchronous\n  * Perform attestation in push model agent binary\n  * Refactor code to use new attestation.rs\n  * Create attestation.rs for Attestation stuff\n  * Move ContextInfo management to its own handler\n  * Adjust context_info.rs after rebase\n  * Add attestation function to ContextInfo structure\n  * Add prohibited signing algorithms, avoid ecschnorr\n  * keylime/config: Use macro to implement PushModelConfigTrait\n  * Introduce keylime-macros and define_view_trait\n  * config: Remove KeylimeConfig structure\n  * config: Remove unnecessary options and lazy initialization\n  * Fix pcr_bank function to send all possible slots\n  * Send Content-Type:application/json on request (#1039)\n  * Send correct 'key_algorithm' in certification_keys (#1035)\n  * Push Model: Persist Attestation Key to file\n  * Add Keylime push model binary to root GNUmakefile\n  * Use singleton to avoid multiple Context allocation\n  * tests: Do not assume `/var/lib/keylime` exists (#1030)\n  * lib/cert: Fix race condition due to use of same file path\n  * payloads: Fix race condition in tests\n  * Add uefi_log_handler.rs to parse UEFI binary\n  * Use IMA log parser to send correct entry count\n  * Add IMA log parser\n  * build(deps): bump once_cell from 1.19.0 to 1.21.3\n  * lib/config/base.rs: Add more unit tests\n  * lib/permissions: Add unit tests\n  * keylime-agent: move JsonWrapper from common.rs to the library\n  * lib/agent_data: Move agent_data related tests from common\n  * common: Replace APIVersion with the library Version structure\n  * keylime_agent: Move secure_mount.rs to the library\n  * lib: Rename keylime_error.rs as error.rs\n  * config: Move config to keylime library\n  * config: Rename push_model_config to push_model\n  * lib: Move permissions.rs from keylime-agent to the lib\n  * Extract Capabilities Negotiation info from TPM (#1014)\n","status":"published","published":"2025-09-16T07:50:08Z","modified":"2026-03-23T04:50:57.095667Z","updated_at":"2026-11-02T15:53:59.92114Z"},{"id":"SUSE-SU-2025:20858-1","title":"Security update for rust-keylime","description":"This update for rust-keylime fixes the following issues:\n\n- CVE-2025-55159: slab: incorrect bounds check in get_disjoint_mut function can lead to undefined behavior or potential crash due to out-of-bounds access (bsc#1248006)\n- CVE-2025-3416: openssl: Use-After-Free in Md::fetch and Cipher::fetch in rust-openssl crate (bsc#1242623)\n- CVE-2024-58266: shlex: certain bytes allowed to appear unquoted and unescaped in command arguments (bsc#1247193)\n- CVE-2024-43806: rustix: rustix::fs::Dir iterator with the linux_raw backend can cause memory explosion (bsc#1229952)\n- CVE-2024-12224: idna: idna accepts Punycode labels that do not produce any non-ASCII when decoded (bsc#1243861)\n\n- RUSTSEC-2024-0006: Multiple issues involving quote API (bsc#1230029)\n","status":"published","published":"2025-10-14T13:18:43Z","modified":"2026-03-23T04:42:58.932899Z","updated_at":"2026-11-02T15:53:59.92114Z"},{"id":"SUSE-SU-2025:20921-1","title":"Recommended update of flake-pilot","description":"This update for flake-pilot fixes the following issues:\n\nUpdate version to 3.1.22.\n\n- Fixes to use flakes as normal user\n\n  Running a flake is a container based instance provisioning\n  and startup. Some part of this process requires root permissions\n  for example mounting the container instance store for the\n  provisioning step. This commit fixes the required calls to\n  be properly managed by sudo.\n\n- seed from entropy\n\n- Fix assignment of random sequence number\n\n  We should use a seed for the sequence as described in\n  https://rust-random.github.io/book/guide-seeding.html#a-simple-number\n  In addition the logic when a random sequence number should\n  be used was wrong and needed a fix regarding resume and\n  attach type flakes which must not use a random sequence\n\n- Pass --init option for resume type flakes\n\n  In resume mode a sleep command is used to keep the container\n  open. However, without the --init option there is no signal\n  handling available. This commit fixes it\n\n- Revert \"kill prior remove when using %remove flag\"\n\n  This reverts commit 06c7d4aa71f74865dfecba399fd08cc2fde2e1f2.\n  no hard killing needed with the event loop entrypoint\n\n- Fixed CVE-2025-55159 slab: incorrect bounds check\n\n  Update to slab 0.4.11 to fix the mentioned CVE.\n  This Fixes bsc#1248004\n\n- Apply clippy fixes\n\n- Create sequence number for the same invocation\n\n  If a flake which is not a resume or attach flake is called twice\n  with the same invocation arguments an error message is displayed\n  to give this invocation a new name via the @NAME runtime option.\n  This commit makes this more comfortable and automatically assigns\n  a random sequence number for the call if no @NAME is given.\n\n- kill prior remove when using %remove flag\n\n  In case the container instance should be removed via the %remove\n  flag, send a kill first, followed by a force remove. The reason\n  for this is because we use a never ending sleep command as entry\n  point for resume type containers. If they should be removed the\n  standard signal send on podman rm will not stop the sleep and\n  after a period of 10 seconds podman sends a kill signal itself.\n  We can speedup this process as we know the entry point command\n  and send the kill signal first followed by the remove which\n  saves us some wait time spent in podman otherwise.\n\n- Fix clippy hints\n\n  variables can be used directly in the format! string\n\n- Prune old images after load\n\n  Make sure no \u003cnone\u003e image references stay in the registry\n\n","status":"published","published":"2025-10-15T12:00:25Z","modified":"2026-03-23T04:50:18.077657Z","updated_at":"2026-11-02T15:53:59.92114Z"},{"id":"SUSE-SU-2025:3944-1","title":"Security update for sccache","description":"This update for sccache fixes the following issues:\n\n  - CVE-2025-55159 - updated slab with the uninit memory access fix (bsc#1248003)\n","status":"published","published":"2025-11-05T08:16:30Z","modified":"2026-03-23T04:51:21.519425Z","updated_at":"2026-11-02T15:54:00.344164Z"},{"id":"SUSE-SU-2025:3954-1","title":"Security update for aws-efs-utils","description":"This update for aws-efs-utils fixes the following issues:\n\nUpdate to version 2.3.3 (bsc#1240044).\n\nSecurity issues fixed:\n\n- CVE-2025-55159: slab: incorrect bounds check in `get_disjoint_mut` function can lead to potential crash due to out-of-bounds access (bsc#1248055).\n- CVE-2020-35881: traitobject: log4rs: out-of-bounds write due to fat pointer layout assumptions (bsc#1249851).\n\nOther issues fixed:\n\n- Build and install efs-proxy binary (bsc#1240044).\n\n- Fixed in version 2.3.3:\n  * Add environment variable support for AWS profiles and regions\n  * Regenerate Cargo.lock with rust 1.70.0\n  * Update circle-ci config\n  * Fix AWS Env Variable Test and Code Style Issue\n  * Remove CentOS 8 and Ubuntu 16.04 from verified Linux distribution list\n\n- Fixed in version 2.3.2:\n  * Update version in amazon-efs-utils.spec to 2.3.1\n  * Fix incorrect package version\n\n- Fixed in version 2.3.1:\n  * Fix backtrace version to resolve ubuntu and rhel build issues\n  * Pin Cargo.lock to avoid unexpected error across images\n\n- Fixed in version 2.3.0:\n  * Add support for pod-identity credentials in the credentials chain\n  * Enable mounting with IPv6 when using with the 'stunnel' mount option\n\n- Fixed in version 2.2.1:\n  * Update log4rs\n\n- Fixed in version 2.2.0\n  * Use region-specific domain suffixes for dns endpoints where missing\n  * Merge PR #211 - Amend Debian control to use binary architecture\n  \n- Fixed in version 2.1.0\n  * Add mount option for specifying region\n  * Add new ISO regions to config file\n  \n- Fixed in version 2.0.4\n  * Add retry logic to and increase timeout for EC2 metadata token\n    retrieval requests\n\n- Fixed in version 2.0.3:\n  * Upgrade py version\n  * Replace deprecated usage of datetime\n  \n- Fixed in version 2.0.2\n  * Check for efs-proxy PIDs when cleaning tunnel state files\n  * Add PID to log entries\n  \n- Fxied in  version 2.0.1\n  * Disable Nagle's algorithm for efs-proxy TLS mounts to improve latencies\n  \n- Fixed in version 2.0.0:\n  * Replace stunnel, which provides TLS encryptions for mounts, with efs-proxy, a component built in-house at AWS.\n    Efs-proxy lays the foundation for upcoming feature launches at EFS.\n\n- Fixed in version 1.36.0:\n  * Support new mount option: crossaccount, conduct cross account mounts via ip address. Use client AZ-ID to choose\n    mount target.\n  \n- Fixed in version 1.35.2:\n  * Revert 'Add warning if using older Version'\n  * Support MacOS Sonoma\n\n- Fixed in version 1.35.1:\n  * Revert openssl requirement change\n  * Revert 'Update EFS Documentation: Clarify Current FIPS Compliance Status'\n  * Update EFS Documentation: Clarify Current FIPS Compliance Status\n  * test: Change repo urls in eol debian9 build\n  * Check private key file size to skip generation\n  * test: Fix pytest that failed since commit 3dd89ca\n  * Fix should_check_efs_utils_version scope\n  * Add warning if using old version\n  * Add 'fsap' option as EFS-only option\n\n- Fixed in version 1.35.0:\n  * Add parameters to allow mount fo pod impersonation feature in EFS CSI Driver\n  * Updated the README with support of Oracle8 distribution\n  * Readme troubleshooting section + table of contents\n  * Add efs-utils Support for MacOS Ventura EC2 instances\n","status":"published","published":"2025-11-05T14:06:34Z","modified":"2026-02-04T02:58:38.153367Z","updated_at":"2026-11-02T15:54:00.344164Z"},{"id":"SUSE-SU-2025:3955-1","title":"Security update for sccache","description":"This update for sccache fixes the following issues:\n\n  - CVE-2025-55159: updated slab with the uninit memory access fix (bsc#1248003)\n","status":"published","published":"2025-11-05T14:47:29Z","modified":"2026-02-04T02:34:13.853543Z","updated_at":"2026-11-02T15:54:00.344164Z"},{"id":"SUSE-SU-2026:20686-1","title":"Security update for gstreamer-rtsp-server, gstreamer-plugins-ugly, gstreamer-plugins-rs, gstreamer-plugins-libav, gstreamer-plugins-good, gstreamer-plugins-base, gstreamer-plugins-bad, gstreamer-docs, gstreamer-devtools, gstreamer","description":"This update for gstreamer-rtsp-server, gstreamer-plugins-ugly, gstreamer-plugins-rs, gstreamer-plugins-libav, gstreamer-plugins-good, gstreamer-plugins-base, gstreamer-plugins-bad, gstreamer-docs, gstreamer-devtools, gstreamer fixes the following issues:\n\nChanges in gstreamer-rtsp-server:\n\n- Update to version 1.26.7:\n  + Fix issues with G_DISABLE_CHECKS \u0026 G_DISABLE_ASSERT.\n  + rtsp-server: tests: Switch to fixtures to ensure pool shutdown\n  + rtsp-server: tests: Fix a few memory leaks\n\nChanges in gstreamer-plugins-ugly:\n\n- Update to version 1.26.7:\n  + No changes, stable version bump only.\n\nChanges in gstreamer-plugins-rs:\n\n- Update to version 1.26.7+git0.6ab75814:\n\n  * tracers: Fix inverted append logic when writing log files\n  * threadshare:\n\n    - examples: standalone: also handle buffer lists\n    - Pad push_list: downgrade Pad flushing log level\n    - sinks: fix / handle query()\n    - backpressure: abort pending items on flush start\n    - udpsink: fix panic recalculating latency from certain\n      executors\n    - audiotestsrc:\n      . support more Audio formats\n      . use AudioInfo\n      . fix latency\n      . act as a pseudo live source by default\n    - runtime task: execute action in downward transition\n    - example cleanups\n    - udpsink: distinguish sync status for latency \u0026 report added\n      latency\n    - sink elements: implement `send_event`\n    - dataqueue elements: report min and max latency\n\n  * rtp:\n\n    - Add linear audio (L8, L16, L24) RTP payloaders / depayloaders\n\n  * rtp: basedepay: reuse last PTS, when possible\n  * skia: Update to skia-safe 0.89\n  * mp4: Update to mp4-atom 0.9\n  * Update dependencies\n  * webrtc: livekit: Drop connection lock after take()\n  * onvifmetadatapay: copy metadata from source buffer\n  * fallbacksrc: Fix custom source reuse case\n  * add `rust-tls-native-roots` feature to the `reqwest` dep\n  * rtpamrpay2:\n    - Actually forward the frame quality indicator\n    - Set frame quality indicator flag\n\n- Add patch to fix reproducibility of package build (boo#1237097)\n\n- Update to version 1.26.6+git20.e287e869:\n\n  * Fix some new clippy 1.90 warnings\n  * colordetect: Don't use deprecated color_name API\n  * deny: Update\n  * quinn: Update to web-transport-quinn 0.8\n  * skia: Update to skia-safe 0.88\n  * Update Cargo.lock\n  * Allow windows-sys 0.61 too\n  * intersink: add sync property\n  * meson: Fix .pc files installation and simplify build output\n    handling. This also fixes the .pc file install directory and\n    ensures that the .pc files are only installed when static\n    builds is enabled.\n- Drop devel subpackage following upstream changes.\n\n- Update to version 1.26.6:\n\n  + aws: Ensure task stopping on paused-to-ready state change\n  + fallbacksrc:\n\n    - Don't panic during retries if the element was shut down in\n      parallel\n    - Don't restart source if the element is just being shut down\n    - Fix some custom source deadlocks\n    - Fix sources only being restarted once\n\n  + gtk4: Try importing dmabufs withouth DMA_DRM caps\n  + inter: Give the appsrc/appsink a name that has the parent\n    element as prefix\n  + mp4: Skip tests using x264enc if it does not exist\n  + rtpgccbwe: avoid clamp() panic when min_bitrate \u003e max_bitrate\n  + rtpmp4gdepay2: allow only constantduration with neither\n    constantsize nor sizelength set\n  + rtprecv: fix race condition on first buffer\n  + speechmatics: Specify rustls as an explicit dependency\n  + spotify: update to librespot 0.7\n  + threadshare:\n\n    - add a blocking adapter element\n    - always use block_on_or_add_subtask\n    - audiotestsrc: fix setting samples-per-buffer...\n    - blocking_adapter: fix Since marker in docs\n    - fix resources not available when preparing asynchronously\n    - fix ts-inter test one_to_one_up_first\n    - have: have Task log its obj\n    - intersink: return from blocking tasks when stopping\n    - inter: update doc example\n    - runtime/pad: lower log level pushing Buffer to flushing pad\n    - separate blocking \u0026 throttling schedulers\n    - update examples\n    - Update to getifaddrs 0.5\n    - Fix macOS build post getifaddrs 0.5 update\n    - Bump up getiffaddrs to 0.1.5 and revert \"udp: avoid\n      getifaddrs in android\"\n    - Reapply \"udp: avoid getifaddrs in android\"\n\n  + transcriberbin: Fix some deadlocks\n  + Update dependencies\n  + webrtc: Migrate to warp 0.4 and switch to tokio-rustls\n  + webrtc/signalling: Fix setting of host address\n  + ci: add script to check readme against plugins list\n  + Fix various new clippy 1.89 warnings\n  + Don't suggest running cargo cinstall after cargo cbuild\n  + meson: Isolate built plugins from cargo target directory\n\n- Update to version 1.26.5+git11.949807a4 (boo#1248053,\n  CVE-2025-55159):\n\n  + rtprecv: fix race condition on first buffer\n  + threadshare: intersink: return from blocking tasks when\n    stopping\n  + threadshare: inter: store upstream latency in InterContext\n  + threadshare: add a blocking adapter element\n  + transcriberbin: Fix settings/state lock order violation in\n    set_property()\n  + transcriberbin: Don't keep state locked while querying upstream\n    latency\n  + threadshare: audiotestsrc: fix setting samples-per-buffer...\n  + rtpgccbwe: avoid clamp() panic when min_bitrate \u003e max_bitrate\n  + fallbacksrc: Don't restart source if the element is just being\n    shut down\n  + aws: Ensure task stopping on paused-to-ready state change\n  + fallbacksrc: Don't panic during retries if the element was shut\n    down in parallel\n  + Update Cargo.lock.\n\n- Update to version 1.26.5:\n\n  + awstranscriber2, awstranslate: Handle multiple stream-start\n    event\n  + ceaX08overlay: support ANY caps features, allowing e.g.\n    memory:GLMemory if downstream supports the overlay composition\n    meta\n  + hlsmultivariantsink: Fix master playlist version\n  + rtprecv: Drop state lock before chaining RTCP packets from the\n    RTP chain function\n  + Add rtpbin2 examples\n  + rtpmp4apay2: fix payload size prefix\n  + rtp: threadshare: fix some property ranges\n  + mpegtslivesrc: Remove leftover debug message\n  + ts-audiotestsrc fixes\n  + threadshare: fix flush for ts-queue ts-proxy \u0026 ts-intersrc\n  + threadshare: fix regression in ts-proxysrc\n  + threadshare: improvements to some elements\n  + threadshare: Enable windows Win32_Networking feature\n  + threadshare: queue \u0026 proxy: fix race condition stopping\n  + threadshare: Also enable windows Win32_Networking_WinSock\n    feature\n  + tracers: pipeline-snapshot: reduce WebSocket connection log\n    level\n  + tracers: queue-levels: add support for threadshare DataQueue\n    related elements\n  + tracers: Update to etherparse 0.19\n  + transcriberbin: Fix handling of upstream latency query\n  + webrtcsink: Move videorate before videoconvert and videoscale\n    to avoid processing frames that would be dropped\n  + Fix various new clippy 1.89 warnings\n\n- Update to version 1.26.4:\n  + aws: s3hlssink: Write to S3 on OutputStream flush\n  + cea708mux: fix clipping function\n  + dav1ddec: Use video decoder base class latency reporting API\n  + elevenlabssynthesizer: fix running time checks\n  + gopbuffer: Push GOPs in order of time on EOS\n  + gtk4: Improve color-state fallbacks for unknown values\n  + gtk4: Add YCbCr memory texture formats\n  + gtk4: Promote set_caps debug log to info\n  + hlssink3: Fix a comment typo\n  + hlssink3: Use closed fragment location in playlist generation\n  + livekit: add room-timeout\n  + mccparse: Convert \"U\" to the correct byte representation\n  + mp4mux: add TAI timestamp element and muxing\n  + threadshare: add a ts-rtpdtmfsrc element\n  + rtp: Update to rtcp-types 0.2\n  + rtpsend: Don't configure a zero min RTCP interval for senders\n  + rtpbin2: Fix handling of unknown PTs and don't warn about\n    incomplete RTP caps to allow for bundling\n  + rtpbin2: Improve rtcp-mux support\n  + rtpbin2: fix race condition on serialized Queries\n  + rtpbin2: sync: fix race condition\n  + rtprecv optimize src pad scheduling\n  + rtprecv: fix SSRC collision event sent in wrong direction\n  + skia: Add harfbuzz, freetype and fontconfig as dependencies in\n    the meson build\n  + tttocea{6,7}08: Disallow pango markup from input caps\n  + ts-intersrc: handle dynamic inter-ctx changes\n  + threadshare: src elements: don't pause the task in downward\n    state transitions\n  + webrtc: sink: avoid recursive locking of the session\n  + webrtcsink: fix deadlock on error setting remote description\n  + webrtcsink: add mitigation modes parameter and signal\n  + webrtc: fix Safari addIceCandidate crash\n  + webrtc-api: Set default bundle policy to max-bundle\n  + WHIP client: emit shutdown after DELETE request\n  + Fix various new clippy 1.88 warnings\n  + Update dependencies\n\n- Update to version 1.26.3:\n\n  + Add new speech synthesis element around ElevenLabs API\n  + cea708mux: fix another WouldOverflow case\n  + cea708mux: support configuring a limit to how much data will be\n    pending.\n  + cea708overlay: also reset the output size on flush stop\n  + gcc: handle out of order packets\n  + fmp4mux: Fix panic on late GOP\n  + livekit: expose a connection state property\n  + mp4mux: add taic box\n  + mp4mux: test the trak structure\n  + pcap_writer: Make target-property and pad-path properties\n    writable again\n  + skia: Don't build skia plugin by default for now\n  + threadshare: cleanups \u0026 usability improvements\n  + threadshare: sync runtime with latest async-io\n  + threadshare: fix kqueue reactor\n  + threadshare: Update to getifaddrs 0.2\n  + threadshare: add new thread-sharing inter elements\n  + threadshare: add a ts-rtpdtmfsrc element\n  + transcriberbin: fix naming of subtitle pads\n  + tttocea708: don't panic if a new service would overflow\n  + webrtc: android: Update Gradle and migrate to\n    FindGStreamerMobile\n  + webrtc: add new examples for stream selection over data channel\n  + webrtcsrc: the webrtcbin get-transceiver index is not\n    mlineindex\n  + webrtcsrc: send CustomUpstream events over control channel ..\n  + webrtcsink: Don't require encoder element for pre-encoded\n    streams\n  + webrtcsink: Don't reject caps events if the codec_data changes\n  + whip: server: pick session-id from the endpoint if specified\n  + cargo: add config file to force\n    CARGO_NET_GIT_FETCH_WITH_CLI=true\n  + Cargo.lock, deny: Update dependencies and log duplicated\n    targo-lexicon\n  + Update windows-sys dependency from \"\u003e=0.52, \u003c=0.59\" to \"\u003e=0.52,\n    \u003c=0.60\"\n  + deny: Add override for windows-sys 0.59\n  + deny: Update lints\n  + cargo_wrapper: Fix backslashes being parsed as escape codes on\n    Windows\n  + Fixes for Clock: non-optional return types\n  + Rename relationmeta plugin to analytics\n\nChanges in gstreamer-plugins-libav:\n\n- Update to version 1.26.7:\n\n  + No changes, stable versionbump only.\n\nChanges in gstreamer-plugins-good:\n\n- Update to version 1.26.7:\n\n  + matroskamux: Properly check if pads are EOS in find_best_pad\n  + qtdemux:\n    - Bad performance with GoPro videos containing FDSC metadata\n      tracks\n    - Fix open/seek perf for GoPro files with SOS track\n    - Handle unsupported channel layout tags gracefully\n    - Set channel-mask to 0 for unknown layout tags\n  + rtspsrc: Send RTSP keepalives in TCP/interleaved modes\n  + v4l2:\n    - Add GstV4l2Error handling in gst_v4l2_get_capabilities\n    - Fix memory leak for DRM caps negotiation\n  + v4l2transform: reconfigure v4l2object only if respective caps\n    changed\n  + Fix issues with G_DISABLE_CHECKS \u0026 G_DISABLE_ASSERT\n\n- Update to version 1.26.6:\n\n  + adaptivedemux2: fix crash due to log\n  + adaptivedemux2: Crash in logging when \"Dropping EOS before next\n    period\"\n  + hlsdemux2: Fix parsing of byterange and init map directives\n  + mpg123audiodec: Always break the decoding loop and relay\n    downstream flow errors upstream\n  + v4l2: Add support for WVC1 and WMV3\n  + Monorepo: dv plugin requires explicit enablement now for a\n    build using the Meson subproject fallback\n\n- Update to version 1.26.5:\n\n  + 4l2: fix memory leak for dynamic resolution change\n  + videorate, imagefreeze: add support for JPEG XS\n\n- Update to version 1.26.4:\n\n  + adaptivedemux2: Fixed reverse playback\n  + matroskademux: Send tags after seeking\n  + qtdemux: Fix incorrect FourCC used when iterating over sbgp\n    atoms\n  + qtdemux: Incorrect sibling type used in sbgp iteration loop\n  + rtph265pay: add profile-id, tier-flag, and level-id to output\n    rtp caps\n  + rtpjpeg: fix copying of quant data if it spans memory segments\n  + soup: Disable range requests when talking to Python's\n    http.server\n  + v4l2videodec: need replace acquired_caps on set_format success\n  + Fix various valgrind/test errors when GST_DEBUG is enabled\n  + More valgrind and test fixes\n  + Various ASAN fixes\n\n- Update to version 1.26.3:\n\n  + aacparse: Fix counting audio channels in program_config_element\n  + adaptivedemux2: free cancellable when freeing transfer task\n  + dashdemux2: Fix seeking in a stream with gaps\n  + decodebin wavparse cannot pull header\n  + imagefreeze: fix not negotiate log when stop\n  + osxvideosink: Use gst_pad_push_event() and post navigation\n    messages\n  + qml6glsink: Allow configuring if the item will consume input\n    events\n  + qtmux: Update chunk offsets when converting stco to co64 with\n    faststart\n  + splitmuxsink: Only send closed message once per open fragment\n  + rtph265depay: CRA_NUT can also start an (open) GOP\n  + rtph265depay: fix codec_data generation\n  + rtspsrc: Don't emit error during close if server is EOF\n  + twcc: Fix reference timestamp wrapping (again)\n  + v4l2: Fix possible internal pool leak\n  + v4l2object: Add support for colorimetry bt2100-pq and 1:4:5:3\n  + wavparse: Don't error out always when parsing acid chunks\n\nChanges in gstreamer-plugins-base:\n\n- Update to version 1.26.7:\n\n  + discoverer: Mark gst_discoverer_stream_info_list_free() as\n    transfer full\n  + riff: Add channel reorder maps for 3 and 7 channel audio\n  + sdp: proper usage of gst_buffer_append\n  + videorate: fix assert fail due to invalid buffer duration\n  + Fix build error with glib \u003c 2.68\n\n- Update to version 1.26.6:\n\n  + decodebin3: Update stream tags\n  + rtpbasedepayload: Avoid potential use-after free\n  + rtspconnection: Add get_url and get_ip return value annotation\n  + gst_rtsp_connection_get_url return value transfer annotation\n    missing\n  + videometa: Fix valgrind warning when deserializing video meta\n  + videorate: don't hold the reference to the buffer in drop-only\n    mode\n  + gst-device-monitor-1.0: Fix device-path regression on Windows\n  + gst-device-monitor-1.0: Add quoting for powershell and cmd\n  + Monorepo: opengl, vorbis, plugins require explicit enablement\n    now for a build using the Meson subproject fallback\n\n- Update to version 1.26.5:\n\n  + audioconvert: mix-matrix causes caps negotiation failure\n  + decodebin3: Don't error on an incoming ONVIF metadata stream\n  + gloverlay: Recompute geometry when caps change, and load\n    texture after stopping and starting again\n  + uridecodebin3: Add missing locking and NULL checks when adding\n    URIs to messages\n  + uridecodebin3: segfault in update_message_with_uri() if no\n    decoder available\n  + videorate, imagefreeze: add support for JPEG XS\n  + gst-device-monitor-1.0: Add shell quoting for launch lines\n  + gst-device-monitor-1.0: Fix criticals, and also accept utf8 in\n    launch lines\n  + gst-device-monitor-1.0: Use gst_print instead of g_print\n\n- Update to version 1.26.4:\n\n  + Revert \"streamsynchronizer: Consider streams having received\n    stream-start as waiting\"\n  + alsa: free conf cache under valgrind\n  + gst-device-monitor: Fix caps filter splitting\n  + Fix various valgrind/test errors when GST_DEBUG is enabled\n  + More valgrind and test fixes\n  + Various ASAN fixes\n\n- Update to version 1.26.3:\n\n  + GstAudioAggregator: fix structure unref in peek_next_sample()\n  + audioconvert: Fix setting mix-matrix when input caps changes\n  + encodebasebin: Duplicate encoding profile in property setter\n  + gl: simplify private\n    gst_gl_gst_meta_api_type_tags_contain_only()\n  + osxvideosink: Use gst_pad_push_event() and post navigation\n    messages\n  + playsink: Fix race condition in stream synchronizer pad cleanup\n    during state changes\n  + python: Fix pulling events from appsink\n  + streamsynchronizer: Consider streams having received\n    stream-start as waiting\n  + urisourcebin: Text tracks are no longer set as sparse stream in\n    urisourcebin's multiqueue\n\nChanges in gstreamer-plugins-bad:\n\n- Update to version 1.26.7:\n\n  + cuda: Fix runtime kernel compile with CUDA 13.0\n  + d3d12convert: Fix crop meta support\n  + d3d12deinterlace: Fix passthrough handling\n  + gst: Fix a few small leaks\n  + matroskamux: Properly check if pads are EOS in find_best_pad\n  + tsdemux: Directly forward Opus AUs without opus_control_header\n  + tsmux: Write a full Opus channel configuration if no matching\n    Vorbis one is found\n  + unixfd: Fix case of buffer with big payload\n  + vacompositor: Correct scale-method properties\n  + webrtc: nice: Fix a use-after-free and a mem leak\n  + Fix all compiler warnings on Fedora\n  + Fix issues with G_DISABLE_CHECKS \u0026 G_DISABLE_ASSERT\n\n- Update to version 1.26.6:\n\n  + analytics: always add GstTensorMeta\n  + cccombiner: Crash fixes\n  + curlsmtpsink: adapt to date formatting issue\n  + decklinkvideosrc: fix decklinkvideosrc becomes unrecoverable if\n    it fails to start streaming\n  + decklinkvideosrc gets into unrecoverable state if device is\n    busy\n  + dwrite: Fix D3D12 critical warning\n  + hlsdemux: Fix parsing of byterange and init map directives\n  + mpegtsmux: Caps event fails with stream type change error\n  + vulkanh24xdec: couple of fixes\n  + vulkanh26xdec: fix discont state handling\n  + waylandsink: add some error handler for event dispatch\n  + zbar: tests: Handle symbol-bytes as not null-terminated\n  + Monorepo: avtp, codec2json, iqa, microdns, openjpeg, qroverlay,\n    soundtouch, tinyalsa plugins require explicit enablement now\n    for a build using the Meson subproject fallback\n\n- Update to version 1.26.5:\n\n  + av1parse: Don't error out on \"currently\" undefined seq-level\n    indices\n  + av1parse: fails to parse AV1 bitstreams generated by FFmpeg\n    using the av1_nvenc hardware encoder\n  + d3d12screencapturedevice: Avoid false device removal on monitor\n    reconfiguration\n  + d3d12screencapturesrc: Fix OS handle leaks/random crash in WGC\n    mode\n  + meson: d3d12: Add support for MinGW DirectXMath package\n  + va: Re-negotiate after FLUSH\n  + vaXXXenc: calculate latency with corrected framerate\n  + vaXXXenc: fix potential race condition\n  + vkphysicaldevice: enable sampler ycbcr conversion,\n    synchronization2 and timeline semaphore features\n  + vulkan: ycbcr conversion extension got promoted in 1.1.0\n  + wasapi2: Port to IMMDevice based device selection\n\n- Fix really disabling faad when building without faad support.\n\n- Do not build with faad in SLE16 where faad2 is not available.\n\n- Update to version 1.26.4:\n\n  + avtp: crf: Setup socket during state change to ensure we handle\n    failure\n  + d3d12screencapture: Add support for monitor add/remove in\n    device provider\n  + mpegtsmux: fix double free caused by shared PMT descriptor\n  + openh264: Ensure src_pic is initialized before use\n  + rtmp2src: various fixes to make it play back AWS medialive\n    streams\n  + ssdobjectdetector: Use correct tensor data index for the scores\n  + v4l2codecs: h265dec: Fix zero-copy of cropped window located at\n    position 0,0\n  + vp9parse: Fix handling of spatial SVC decoding\n  + vp9parse: Revert \"Always default to super-frame\"\n  + vtenc: Fix negotiation failure with profile=main-422-10\n  + vulkan: Fix drawing too many triangles in fullscreenquad\n  + vulkanfullscreenquad: add locks for synchronisation\n  + Fix various valgrind/test errors when GST_DEBUG is enabled\n  + More valgrind and test fixes\n  + Various ASAN fixes\n\n- Provide and Obsolete gstreamer-1.20-plugin-openh264 too, not just\n  gstreamer-plugin-openh264.\n\n- Update to version 1.26.3:\n\n  + amc: Overhaul hw-accelerated video codecs detection\n  + bayer2rgb: Fix RGB stride calculation\n  + d3d12compositor: Fix critical warnings\n  + dashsink: Fix failing test\n  + decklink: calculate internal using values closer to the current\n    clock times\n  + decklinkvideosink: show preroll frame correctly\n  + decklink: clock synchronization after pause\n  + h266parser: Fix overflow when parsing subpic_level_info\n  + lcevcdec: Check for errors after receiving all enhanced and\n    base pictures\n  + meson: fix building -bad tests with disabled soundtouch\n  + mpegts: handle MPEG2-TS with KLV metadata safely by preventing\n    out of bounds\n  + mpegtsmux: Corrections around Teletext handling\n  + srtsink: Fix header buffer filtering\n  + transcoder: Fix uritranscodebin reference handling\n  + tsdemux: Allow access unit parsing failures\n  + tsdemux: Send new-segment before GAP\n  + vulkanupload: fix regression for uploading VulkanBuffer\n  + vulkanupload: fix regression when uploading to single memory\n    multiplaned memory images\n  + webrtcbin: disconnect signal ICE handlers on dispose\n  + {d3d12,d3d11}compositor: Fix negative position handling\n  + {nv,d3d12,d3d11}decoder: Use interlace info in input caps\n\n- Build with noopenh264, move plugin to main package.\n- Drop conditionals for fdk-aac, explicitly build it for all\n  targets.\n\n- Move faad plugin to main package.\n\nChanges in gstreamer-docs:\n\n- Update to version 1.26.7:\n  + No changes, stable bump only.\n  + Update docs.\n\nChanges in gstreamer-devtools:\n\n- Update to version 1.26.7:\n\n  + Fix issues with G_DISABLE_CHECKS \u0026 G_DISABLE_ASSERT\n\n- Update to version 1.26.6:\n\n  + validate: http-actions: Replace GUri with GstURI for GLib 2.64\n    compatibility\n  + Fix memory leak and use of incorrect context\n\n- Update to version 1.26.5:\n\n  + No changes, stable bump only.\n\n- Update vendored dependencies (boo#1248053, CVE-2025-55159).\n\n- Update to version 1.26.4:\n\n  + Update various Rust dependencies\n\n- Update to version 1.26.3:\n\n  + validate: More memory leaks\n  + validate: Valgrind fixes\n\nChanges in gstreamer:\n\n- Update to version 1.26.7:\n\n  + Highlighted bugfixes in 1.26.7:\n\n    - cea608overlay: improve handling of non-system memory\n    - cuda: Fix runtime kernel compile with CUDA 13.0\n    - d3d12: Fix crop meta support in converter and passthrough\n      handling in deinterlacer\n    - fallbacksrc: source handling improvements; no-more-pads\n      signal for streams-unaware parents\n    - inter: add properties to fine tune the inner elements\n    - qtdemux: surround sound channel layout handling fixes and\n      performance improvements for GoPro videos\n    - rtp: Add linear audio (L8, L16, L24) RTP payloaders /\n      depayloaders\n    - rtspsrc: Send RTSP keepalives in TCP/interleaved modes\n    - rtpamrpay2: frame quality indicator flag related fixes\n    - rtpbasepay2: reuse last PTS when possible, to work around\n      problems with NVIDIA Jetson AV1 encoder\n    - mpegtsmux, tsdemux: Opus audio handling fixes\n    - threadshare: latency related improvements and many other\n      fixes\n    - matroskamux, tsmux, flvmux, cea608mux: Best pad determination\n      fixes at EOS\n    - unixfd: support buffers with a big payload\n    - videorate unknown buffer duration assertion failure with\n      variable framerates\n    - editing services: Make GESTimeline respect\n      SELECT_ELEMENT_TRACK signal discard decision; memory leak\n      fixes\n    - gobject-introspection annotation fixes\n    - cerbero: Update meson to 1.9.0 to enable Xcode 26\n      compatibility\n    - Various bug fixes, build fixes, memory leak fixes, and other\n      stability and reliability improvements\n\n  + gstreamer:\n\n    - controller: Fix get_all() return type annotation\n    - gst-launch: Do not assume error messages have a src element\n    - multiqueue: Fix object reference handling in signal callbacks\n    - netclientclock: Fix memory leak in error paths\n\n- Update to version 1.26.6:\n\n  + Highlighted bugfixes in 1.26.6:\n\n    - analytics GstTensorMeta handling changes (see note below)\n    - closed caption combiner and transcriberbin stability fixes\n    - decklinkvideosrc: fix unrecoverable state after failing to\n      start streaming because device is busy\n    - decodebin3 tag handling improvements\n    - fallbacksrc: Fix sources only being restarted once, as well\n      as some deadlocks and race conditions on shutdown\n    - gtk4paintablesink: Try importing dmabufs withouth DMA_DRM\n      caps\n    - hlsdemux2: Fix parsing of byterange and init map directives\n    - rtpmp4gdepay2: allow only constantduration with neither\n      constantsize nor sizelength set\n    - spotifysrc: update to librespot 0.7 to make work after recent\n      Spotify changes\n    - threadshare: new blocking adapter element for use in front of\n      block elements such as sinks that sync to the clock\n    - threadshare: various other threadshare element fixes and\n      improvements\n    - v4l2: Add support for WVC1 and WMV3\n    - videorate: possible performance improvements when operating\n      in drop-only mode\n    - GstBaseParse fixes\n    - Vulkan video decoder fixes\n    - Fix gst-device-monitor-1.0 tool device-path regression on\n      Windows\n    - Monorepo development environment builds fewer plugins using\n      subprojects by default, those require explicit enablement now\n    - Python bindings: Handle buffer PTS, DTS, duration, offset,\n      and offset-end as unsigned long long (regression fix)\n    - Cerbero: Reduce recipe parallelism in various cases and dump\n      cerbero and recipe versions into datadir during packaging\n    - Various bug fixes, build fixes, memory leak fixes, and other\n      stability and reliability improvements\n\n  + Possibly breaking behavioural changes:\n\n    - Previously it was guaranteed that there is only ever up to\n      one GstTensorMeta per buffer. This is no longer true and code\n      working with GstTensorMeta must be able to handle multiple\n      GstTensorMeta now.\n\n  + gstreamer:\n\n    - baseparse: Try harder to fixate caps based on upstream in\n      default negotiation\n    - gst-discoverer reports 1x1 dimensions for \"valid\" MP4 files\n    - baseparse: don't clear most sticky events after a FLUSH_STOP\n      event\n    - gstreamer: Disable miniobject inline functions for\n      gobject-introspection for non-subprojects too\n    - gstreamer: Make sure to zero-initialize the GValue before\n      G_VALUE_COLLECT_INIT\n    - ptp: Fix a new Rust 1.89 compiler warning on Windows\n    - ptp: Fix new compiler warning with Rust 1.89\n    - Segmentation fault when compiled with\n      \"-ftrivial-auto-var-init=pattern\". Use of unitialized GValue\n\n- Update to version 1.26.5:\n\n  + Highlighted bugfixes:\n\n    - audioconvert: Fix caps negotiation regression when using a\n      mix matrix\n    - cea608overlay, cea708overlay: Accept GPU memory buffers if\n      downstream supports the overlay composition meta\n    - d3d12screencapture source element and device provider fixes\n    - decodebin3: Don't error on an incoming ONVIF metadata stream\n    - uridecodebin3: Fix potential crash when adding URIs to\n      messages, e.g. if no decoder is available\n    - v4l2: Fix memory leak for dynamic resolution change\n    - VA encoder fixes\n    - videorate, imagefreeze: Add support for JPEG XS\n    - Vulkan integration fixes\n    - wasapi2 audio device monitor improvements\n    - threadshare: Many improvements and fixes to the generic\n      threadshare and RTP threadshare elements\n    - rtpbin2 improvements and fixes\n    - gst-device-monitor-1.0 command line tool improvements\n    - Various bug fixes, build fixes, memory leak fixes, and other\n      stability and reliability improvements\n\n  + gstreamer:\n\n    - aggregator: add sub_latency_min to pad queue size\n    - build: Disable C5287 warning on MSVC\n\n- Update to version 1.26.4:\n\n  + Highlighted bugfixes in 1.26.4:\n\n    - adaptivedemux2: Fixed reverse playback\n    - d3d12screencapture: Add support for monitor add/remove in\n      device provider\n    - rtmp2src: various fixes to make it play back AWS medialive\n      streams\n    - rtph265pay: add profile-id, tier-flag, and level-id to output\n      rtp caps\n    - vp9parse: Fix handling of spatial SVC decoding\n    - vtenc: Fix negotiation failure with profile=main-422-10\n    - gtk4paintablesink: Add YCbCr memory texture formats and other\n      improvements\n    - livekit: add room-timeout\n    - mp4mux: add TAI timestamp muxing support\n    - rtpbin2: fix various race conditions, plus other bug fixes\n      and performance improvements\n    - threadshare: add a ts-rtpdtmfsrc element, implement run-time\n      input switching in ts-intersrc\n    - webrtcsink: fix deadlock on error setting remote description\n      and other fixes.\n    - cerbero: WiX installer: fix missing props files in the MSI\n      packages\n    - smaller macOS/iOS package sizes\n    - Various bug fixes, build fixes, memory leak fixes, and other\n      stability and reliability improvements\n\n  + gstreamer:\n\n    - tracers: Fix deadlock in latency tracer\n    - Fix various valgrind/test errors when GST_DEBUG is enabled\n    - More valgrind and test fixes\n    - Various ASAN fixes\n\n- Update to version 1.26.3:\n\n  + Highlighted bugfixes in 1.26.3:\n\n    - Security fix for the H.266 video parser\n    - Fix regression for WAV files with acid chunks\n    - Fix high memory consumption caused by a text handling\n      regression in uridecodebin3 and playbin3\n    - Fix panic on late GOP in fragmented MP4 muxer\n    - Closed caption conversion, rendering and muxing improvements\n    - Decklink video sink preroll frame rendering and clock drift\n      handling fixes\n    - MPEG-TS demuxing and muxing fixes\n    - MP4 muxer fixes for creating very large files with faststart\n      support\n    - New thread-sharing 1:N inter source and sink elements, and a\n      ts-rtpdtmfsrc\n    - New speech synthesis element around ElevenLabs API\n    - RTP H.265 depayloader fixes and improvements, as well as TWCC\n      and GCC congestion control fixes\n    - Seeking improvements in DASH client for streams with gaps\n    - WebRTC sink and source fixes and enhancements, including to\n      LiveKit and WHIP signallers\n    - The macOS osxvideosink now posts navigation messages\n    - QtQML6GL video sink input event handling improvements\n    - Overhaul detection of hardware-accelerated video codecs on\n      Android\n    - Video4Linux capture source fixes and support for BT.2100 PQ\n      and 1:4:5:3 colorimetry\n    - Vulkan buffer upload and memory handling regression fixes\n    - gst-python: fix various regressions introduced in 1.26.2\n    - cerbero: fix text relocation issues on 32-bit Android and fix\n      broken VisualStudio VC templates\n    - packages: ship pbtypes plugin and update openssl to 3.5.0 LTS\n    - Various bug fixes, build fixes, memory leak fixes, and other\n      stability and reliability improvements\n\n  + gstreamer:\n\n    - aggregator: Do not set event seqnum to INVALID\n    - baseparse: test: Fix race on test start\n    - pad: Only remove TAG events on STREAM_START if the stream-id\n      actually changes\n    - utils: Mark times array as static to avoid symbol conflict\n      with the POSIX function\n    - vecdeque: Use correct index type gst_vec_deque_drop_struct()\n","status":"published","published":"2026-03-05T15:55:51Z","modified":"2026-03-23T04:53:08.512664Z","updated_at":"2026-11-02T15:54:01.953589Z"},{"id":"SUSE-SU-2026:20744-1","title":"Security update for rust-keylime","description":"This update for rust-keylime fixes the following issues:\n\n- Update to version 0.2.8+116:\n- CVE-2026-25727: Update vendored crates to fix a date parser can lead to stack exhaustion in Time. (bsc#1257908)\n","status":"published","published":"2026-03-16T15:29:27Z","modified":"2026-03-25T17:23:42.555102Z","updated_at":"2026-11-02T15:54:01.953589Z"},{"id":"SUSE-SU-2026:22302-1","title":"Security update for glycin-loaders","description":"This update for glycin-loaders fixes the following issues\n\n- CVE-2025-55159: slab: incorrect bounds check in get_disjoint_mut function can lead to undefined behavior or potential\n  crash due to out-of-bounds access (bsc#1248035).\n- CVE-2025-58160: tracing-subscriber: Tracing log pollution (bsc#1249010).\n","status":"published","published":"2026-07-06T20:10:18Z","modified":"2026-07-06T20:10:18Z","updated_at":"2026-11-02T15:54:03.080707Z"}]}}