Packages changed:
  MicroOS-release (20260908 -> 20260909)
  expat (2.8.2 -> 2.8.4)
  kernel-source (7.2.3 -> 7.2.4)
  libarchive (3.8.7 -> 3.8.9)
  patterns-microos
  python-dbus-python (1.3.2 -> 1.4.0)
  python313-packaging (26.2 -> 26.3)
  samba (4.24.5+git.481.dba78dbdea -> 4.24.6+git.488.e38f6c96c62)
  sdbootutil (1+git20260903.f91f636 -> 1+git20260909.7cfa1f0)
  selinux-policy (20260826 -> 20260908)
  xen (4.22.0_02 -> 4.22.0_04)

=== Details ===

==== MicroOS-release ====
Version update (20260908 -> 20260909)
Subpackages: MicroOS-release-appliance MicroOS-release-dvd

- automatically generated by openSUSE-release-tools/pkglistgen

==== expat ====
Version update (2.8.2 -> 2.8.4)

- update to 2.8.4:
  * Security fixes:
  * CVE-2026-66046, bsc#1275732: denial of service vulnerability
    caused by quadratic algorithmic complexity in the storeAtts()
    function in xmlparse.c
  * CVE-2026-76641, bsc#1275915: out-of-bounds read vulnerability
    that allows attackers to trigger memory corruption
  * CVE-2026-76957, bsc#1275859: lacks handler call depth tracking
    with custom encoding callbacks, use-after-free can occur
  * CVE-2026-76956, bsc#1275860: misinterpretation of getentropy's
    return code leads to insufficient entropy, vulnerable to hash
    flooding denial of service
  * Other fixes:
  * CMake: only add /source-charset:utf-8 when /utf-8 is not present
  * lib: resolve undefined behavior from overshifting a signed int
  * lib: support read-only hash table lookup with non-zero-terminated
    keys
  * lib: use a C99 bool for ENTITY.open
  * version info bumped from 13:3:12 to 13:4:12
- update to 2.8.3:
  * Security fixes:
  * CVE-2026-72522, bsc#1275594: out-of-bounds read and resultant
    infinite loop due to low surrogates being treated the same as
    high surrogates during Unicode processing
  * Other fixes:
  * fix support for 2+ GiB documents (regression from 2.8.2)
  * reject empty version in the XML declaration
  * fix printf format for AIX
  * CMake|AIX: enable EXPAT_DEV_URANDOM by default
  * version info bumped from 13:2:12 to 13:3:12

==== kernel-source ====
Version update (7.2.3 -> 7.2.4)

- Linux 7.2.4 (bsc#1012628).
- platform/chrome: sensorhub: Fix dropped timestamp events and
  log spam (bsc#1012628).
- ACPI: scan: Do not combine resources that overlap completely
  (bsc#1012628).
- selftests/mm: fix on-fault-limit false failure under sudo-rs
  (bsc#1012628).
- udf: Fix i_lenExtents truncation on 32-bit kernels
  (bsc#1012628).
- timer: Keep debugobjects state consistent in
  migrate_timer_list() (bsc#1012628).
- timekeeping: Check the return value of tk_get_aux_ts64 in
  __do_adjtimex() (bsc#1012628).
- taskstats: fix cpumask parsing cutting off the last character
  (bsc#1012628).
- smack: fix cred UAF in smack_file_send_sigiotask()
  (bsc#1012628).
- signal: avoid shared siginfo namespace rewrites (bsc#1012628).
- sticon/parisc: Detect default STI graphics card for console
  output (bsc#1012628).
- sysctl: move the "cad_pid" entry from pid_table[] to
  kern_reboot_table[] (bsc#1012628).
- tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout (bsc#1012628).
- zloop: truncate finished zones to zone capacity (bsc#1012628).
- xarray: honor XA_FLAGS_ACCOUNT in xas_split_alloc()
  (bsc#1012628).
- w1: ds28e17: reject an oversize length on an I2C block read
  (bsc#1012628).
- vsock/virtio: flush works in dependency order (bsc#1012628).
- wifi: mt76: mt7996: validate default EEPROM firmware size
  (bsc#1012628).
- wifi: mt76: mt7996: fix TX DMA mapping leak for AddBA req frames
  (bsc#1012628).
- wifi: mt76: mt7996: bound the device EEPROM address before
  the EFUSE copy (bsc#1012628).
- wifi: mt76: mt7925: cancel mlo_pm_work on stop (bsc#1012628).
- wifi: mt76: mt7915: bound the device EEPROM address before
  the EFUSE copy (bsc#1012628).
- wifi: mt76: mt7615: avoid waiting for mac work under the mt76
  mutex (bsc#1012628).
- wifi: rtw89: pci: add .shutdown callback to stop rfkill polling
  on reboot (bsc#1012628).
- wifi: rtw88: pci: fix resource leak on failed NAPI setup
  (bsc#1012628).
- wifi: rtw88: Fix potential memory leak in rtw_txq_push_skb()
  (bsc#1012628).
- wifi: rtlwifi: rtl8192du: Fix possible memory leak in
  rtl92du_init_sw_vars() (bsc#1012628).
- wifi: rtlwifi: rtl8192du: check QoS TID before indexing tids
  (bsc#1012628).
- wifi: rtl818x: initialize eeprom_93cx6 struct to zero
  (bsc#1012628).
- wifi: mwifiex: Detach sync cmd buffer on interrupted wait
  (bsc#1012628).
- mm/kmemleak: report RCU-tasks quiescent states during the scan
  (bsc#1012628).
- mm/kmemleak: stop the task stack scan early when interrupted
  (bsc#1012628).
- crypto: atmel-ecc - avoid stale fallback key after set_secret
  failure (bsc#1012628).
- crypto: atmel-ecc - clean up and improve ECDH comments
  (bsc#1012628).
- crypto: iaa - unmap dst before software fallback on decompress
  (bsc#1012628).
- fuse: copy request headers via a stack buffer for io-uring
  (bsc#1012628).
- fuse: decouple fuse_ring creation from ent registration
  (bsc#1012628).
- wifi: rtl8xxxu: fix use-after-free from rx_urb_wq on stop
  (bsc#1012628).
- wifi: iwlwifi: dvm: fix memory leak in iwl_op_mode_dvm_start()
  (bsc#1012628).
- wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control()
  (bsc#1012628).
- i3c: renesas: Perform Dynamic Address Assignment on resume
  (bsc#1012628).
- i3c: renesas: Restore STDBR and EXTBR registers on resume
  (bsc#1012628).
- i3c: renesas: Reset the controller on resume (bsc#1012628).
- i3c: renesas: Reconfigure the DATBAS register on re-attach
  (bsc#1012628).
- i3c: renesas: Follow the reset deassert order used in probe
  (bsc#1012628).
- i3c: renesas: Clean DATBAS register on detach (bsc#1012628).
- i3c: renesas: Check that the transfer is valid before accessing
  it (bsc#1012628).
- i3c: master: svc: bound IBI payload to the requested
  max_payload_len (bsc#1012628).
- i3c: master: Fix info leak and UAF in device unregister path
  (bsc#1012628).
- i3c: master: adi: initialize the lock before enabling interrupts
  (bsc#1012628).
- i3c: Fix unlocked dereference of dev->desc in
  i3c_device_get_supported_xfer_mode() (bsc#1012628).
- dm-pcache: fix use-after-free and invalid seg operations in
  kset_replay() (bsc#1012628).
- dm-pcache: fix implicit u8 truncation of gc_percent in message
  handler (bsc#1012628).
- dm-pcache: only hand out initialized cache segments
    ... changelog too long, skipping 1228 lines ...
- commit b3d022a

==== libarchive ====
Version update (3.8.7 -> 3.8.9)

- Update to 3.8.9:
  * unzip: Windows port (#3167)
  * various further bugfixes: https://github.com/libarchive/libarchive/compare/v3.8.8...v3.8.9
- 3.8.8:
  * zip: support for reading encrypted zipx formats (bzip2, lzma, ppmd, xz, zstd) (#2685)
  * build: fix build with glibc 2.43 (#2969)
  * libarchive core: various NULL pointer, double-free, buffer overrun and integer overflow fixes (#2905, #2927, #2928, #2942, #2957, #2971, #2973, #2988, #2998, #3009, #3010, #3011, #3012, #3019, #3036, #3037, #3040, #3064, #3083, #3114, #3146)
  * windows: remove support for WinCrypt, fix GetTempPathW TOCTOU race condition (#2739, #3044)
  * filters (bzip2, gzip, lz4, uu, zstd): fixes for large archives, truncated input handling and out-of-bounds access (#2526, #3033, #3050, #3054, #3073, #3085, #3093, #3100, #3103, #3115, #3132)
  * 7-zip: multiple heap overflow, hardening and streamable reading fixes (#2923, #2929, #2980, #2985, #3002, #3006, #3062, #3067, #3074, #3099, #3102, #3119)
  * cab: multi-volume parser fixes and hardening against invalid/truncated headers (#2979, #3000, #3144, #3145, #3153)
  * cpio: pathname validation and out-of-bounds read fixes (#2984, #3043, #3055, #3095, #3158, #3168)
  * iso9660: fix path normalization, Joliet overflow/infinite loop and memory leaks (#2968, #2974, #2978, #2983, #3017, #3021, #3029, #3045, #3117)
  * mtree: fix hex/time value parsers and NULL dereferences (#2930, #2982, #3007, #3008, #3018, #3032, #3057)
  * RAR/RAR5: fix bound checks, dangling pointers and integer underflow (#3004, #3015, #3047, #3048, #3081, #3087, #3091, #3105, #3121)
  * tar: harden timestamp parsing, fix OOB with empty wide character directory names (#2991, #3038, #3052)
  * warc: fix header allocation leak on overflow (#3061)
  * xar: fix integer overflows, memory leaks and OOB writer accesses (#3013, #3028, #3030, #3032, #3041, #3060)
  * zip: reject overlong/empty pathnames, limit LZMA memory usage (#2981, #2993, #2996)
- Removed add-missing-tests.patch: upstream 3.8.9 tarball now ships
  test_read_format_cab_skip_malformed.c and .cab.uu again, the patch
  no longer applies and is no longer needed

==== patterns-microos ====
Subpackages: patterns-microos-alt_onlyDVD patterns-microos-base patterns-microos-base-packagekit patterns-microos-base-zypper patterns-microos-basesystem patterns-microos-cloud patterns-microos-cockpit patterns-microos-defaults patterns-microos-desktop-common patterns-microos-desktop-kde patterns-microos-ima_evm patterns-microos-onlyDVD patterns-microos-ra_agent patterns-microos-ra_verifier patterns-microos-selinux patterns-microos-sssd_ldap

- Make account-utils the default

==== python-dbus-python ====
Version update (1.3.2 -> 1.4.0)

- update to 1.4.0:
  * Automatically set the NO_REPLY message flag in call_async if
    there is no reply handler and no error handler
  * Add arg0namespace match rule support
    Hofstee)
  * Add argNpath match rules support
  * Generate a valid sdist from `meson dist`
  * Mention more alternatives to this package in the README
  * Don't require tomllib when generating dist tarball on Python
    ≥ 3.11
  * Fix compilation with Python ≥ 3.13 in some situations
  * Avoid using distutils in setup.py (Simon McVittie)
  * Fix a typo in example code (dbus-python!25, Robert Ancell)
  * Safer handling of weak references (Simon McVittie)
- add missing keyring
- add Revert-using-Py_TPFLAGS_MANAGED_WEAKREF.patch from fedora,
  fixes testsuite failures on newer python versions

==== python313-packaging ====
Version update (26.2 -> 26.3)

- update to 26.3:
  * Add a public :class:`~packaging.ranges.VersionRange` API and
    :meth:`SpecifierSet.to_range()
    <packaging.specifiers.SpecifierSet.to_range>`, representing
    the versions a specifier set accepts as an interval set that
    supports intersection, union, difference, complement, set
    relations, membership tests, and filtering.
    :meth:`~packaging.ranges.VersionRange.to_specifier_set`
    converts a range back to a
    :class:`~packaging.specifiers.SpecifierSet` where a PEP 440
    form exists. (:pull:`1267`, :pull:`1270`, :pull:`1298`)
  * PEP 808: accept Metadata-Version: 2.6. (:pull:`1194`)
  * Add a limit argument to parse_tag() for compressed tag sets.
    (:issue:`1220`)
  * Add a prefer_sdist_predicate argument to Pylock.select() to
    prefer source distributions over wheels for selected
    packages. (:pull:`1334`)
  * Add :func:`~packaging.tags.pure_python_tags` to generate the
    pure-Python tags for a Python version without touching the
    running platform. (:pull:`1346`)
  * Add :meth:`SpecifierSet.is_subset()
    <packaging.specifiers.SpecifierSet.is_subset>`,
    :meth:`~packaging.specifiers.SpecifierSet.is_superset`, and
    :meth:`~packaging.specifiers.SpecifierSet.is_disjoint`, which
    compare the versions two specifier sets accept.
    (:pull:`1313`)
  * Drop support for Python 3.8; packaging now requires Python
    3.9 or later. (:pull:`1157`)
  * Prefer native linux_* platform tags over manylinux and
    musllinux tags on Linux. (:issue:`160`)
  * Raise InvalidVersion instead of TypeError when Version is
    given a non-string. (:pull:`1319`)
  * Raise InvalidVersion for non-string pre-release letters
    passed to Version.from_parts. (:pull:`1241`)
  * Fix an AttributeError when hashing internally trimmed
    versions. (:pull:`1242`)
  * Fix SpecifierSet.is_unsatisfiable for post-release boundary
    intersections. (:pull:`1257`)
  * Make Requirement.__hash__ consistent with __eq__ for
    trailing-zero-equivalent specifiers (e.g. foo==1.0.0 and
    foo==1.0.0.0), so equal requirements hash equal and
    deduplicate in sets and dicts. (:pull:`1232`)
  * Normalize requested extra names before comparing or hashing
    requirements. (:issue:`644`)
  * Preserve a Requirement's specifier prereleases override
    across a pickle round trip. (:issue:`1204`)
  * Raise InvalidRequirement instead of InvalidSpecifier when a
    requirement contains an invalid specifier. (:pull:`1332`)
  * Clarify the error for post-release prefix wildcards like
    ==1.0.post1.*. (:pull:`1299`)
  * Preserve quoting semantics when serializing marker values, so
    round-tripped markers parse back to the same marker.
    (:pull:`1213`)
  * Keep the parentheses of a nested group when serializing
    markers. (:pull:`1316`)
  * Normalize extra and dependency_groups values in nested
    markers at parse time. (:pull:`1246`, :pull:`1310`)
  * Raise UndefinedComparison when a set-valued variable like
    extras is used outside the membership form. (:pull:`1265`)
  * Raise UndefinedEnvironmentName (a KeyError subclass) for
    missing environment keys during marker evaluation.
    (:pull:`1276`)
  * Wrap malformed string literal errors in InvalidMarker /
    InvalidRequirement instead of leaking a low-level error.
    (:pull:`1249`)
  * Reject requirements and markers with a trailing line break.
    (:pull:`1345`)
  * Collect all from_email validation errors into one
    ExceptionGroup instead of raising the first. (:pull:`1268`)
  * Accept the UTF-8 charset case-insensitively in email
    payloads. (:pull:`1330`)
  * Reject malformed Description-Content-Type values.
    (:pull:`1329`)
  * Don't rewrite user values that contain {field} placeholders
    in error messages. (:pull:`1327`)
  * Route multipart email payloads to unparsed instead of
    asserting. (:pull:`1247`)
  * Make InvalidMetadata and CyclicDependencyGroup picklable.
    (:pull:`1328`)
  * Fold every line boundary str.splitlines recognizes when
    writing a header with
    :class:`~packaging.metadata.RFC822Message`. (:pull:`1356`)
  * Raise InvalidLicenseExpression for misplaced WITH clauses and
    empty LicenseRef- names. (:pull:`1266`)
  * Raise InvalidLicenseExpression instead of KeyError for a
    LicenseRef- with a + suffix. (:pull:`1219`)
  * Raise InvalidTag from parse_tag() for tags with the wrong
    number of components. (:pull:`1238`)
  * Reject empty tag components in parse_wheel_filename() and
    parse_tag(). (:pull:`1234`)
  * Reject an empty project name in the wheel and sdist filename
    parsers. (:pull:`1305`)
  * Reject wheel filenames with a trailing newline.
    (:pull:`1341`)
  * Reject wheel tags whose interpreter component is not an
    identifier. (:issue:`577`)
  * is_normalized_name now rejects names with collapsed double
    hyphens like a--b. (:pull:`1230`)
  * Fix duplicate explicit abi3t tags. (:pull:`1245`)
    ... changelog too long, skipping 58 lines ...
  * Use nox's uv integration. (:pull:`1057`)

==== samba ====
Version update (4.24.5+git.481.dba78dbdea -> 4.24.6+git.488.e38f6c96c62)
Subpackages: libldb2 samba-ad-dc-libs samba-client samba-client-libs samba-libs

- Build and install pycache files; (bsc#1274812)
- Update to 4.24.6
  * leases torture test flappy (marked flappy); (bso#15978).
  * Memory leak in DRS when replication fails; (bso#16065).
  * vfs_ceph_snapshots: smbd panics on snapshot access for a
    share mounted at the CephFS root ("/"); (bso#16176).
  * race condition in pthreadpool when forking; (bso#16191).
  * witness test flappy needs to be fixed; (bso#16077).
  * temporary read of unrelated or non-existing memory in s3 dfs
    server; (bso#16093).
  * source4/dsdb/samdb/cracknames.c doesn't use
    ldb_binary_encode_string() consistently; (bso#16094).
  * dsgetdcname() may not detect an active directory domain if
    the netbios domain name is given and nmbd nor the nbt service
    is available; (bso#16153).
  * ndr_{push,pull,print}_{timeval,timespec} encode/decode the
    value twice; (bso#16199).
  * vfs_ceph_new: smbd crashes when mixing proxy and non-proxy
    CephFS shares; (bso#16186).
  * CTDB doesn't send tickle ACKs when taking over a released IP;
    (bso#15994).
  * CTDB can run nested elections, in rare circumstances;
    (bso#16152).
- Update update-samba-security-profile for selinux
  Create and label /run/samba/nmbd and /run/samba/winbindd
  as this doesn't work properly in DC configurations (bsc#1268532)

==== sdbootutil ====
Version update (1+git20260903.f91f636 -> 1+git20260909.7cfa1f0)
Subpackages: sdbootutil-dracut-measure-pcr sdbootutil-snapper sdbootutil-tukit

- Update to version 1+git20260909.7cfa1f0:
  * Drop PCR warning when is not part of the policy
- Update to version 1+git20260908.c641fc2:
  * Update the shim when required
  * Warn when recovery PIN is different from recovery key
  * Improves extra boot entries support
  * Better report when the default snapshot diverges
  * Explain how to do re-enrolling if recovery PIN fails
  * Explain why update-prediction fails and how to solve it
  * Hide comparison output
  * Add bootctl default entry in the prediction

==== selinux-policy ====
Version update (20260826 -> 20260908)
Subpackages: selinux-policy-targeted

- Update to version 20260908:
  * fix NetworkManager dnsmasq-forwarders.conf labeling (bsc#1260038)
  * Fix for (open)SUSE (bsc#1270243)
  * Fix for (open)SUSE (bsc#1277439)

==== xen ====
Version update (4.22.0_02 -> 4.22.0_04)

- bsc#1276838 - VUL-0: CVE-2026-62437: xen: x86: DMs may cause mem
  leak by IRQ binding (XSA-509)
  6a8f18ad-pass-through-disallow-pt_irq_create_bind-on-dying-domains.patch
- bsc#1276839 - VUL-0: CVE-2026-79602: xen: x86: improper handling
  of HVM emulation return codes (XSA-510)
  6a759f74-emul-cope-with-internal-handlers-returning-X86EMUL_RETRY.patch
- bsc#1276841 - VUL-0: CVE-2026-79603: xen: unconditionally do TLB
  flushing ahead of page scrubbing (XSA-511)
  6a71bd97-xen-page_alloc-ensure-TLB-flush-is-done-ahead-of-page-scrubbing.patch