Packages changed:
  gnutls
  gzip
  libalternatives (1.2+31.da24cd4 -> 2.0+0.4f22c01)
  libgit2 (1.9.6 -> 1.9.7)
  librist
  libssh
  libupnp (22.0.4 -> 22.0.6)
  ovmf
  publicsuffix (20260708 -> 20260725)
  python-h2 (4.3.0 -> 4.4.1)
  qt6-base
  vim (9.2.0780 -> 9.2.0901)
  wget
  yast2-storage-ng (5.0.49 -> 5.0.50)
  yelp (49.1+3 -> 49.2)

=== Details ===

==== gnutls ====
Subpackages: libgnutls-dane0 libgnutls30 libgnutls30-32bit

- FIPS: Deprecate ECDSA siggen with less than 128-bit (bsc#1265613)
  * NIST SP 800-131Arev3 marked ECDSA siggen < 128-bit of security
    strength as deprecated after the deadline of 31 dic 2030.
  * Add gnutls-FIPS-Deprecate-ECDSA-with-less-that-128-bit.patch
- FIPS: Mark SHA-224 and SHA3-224 as legacy (bsc#1265609, bsc#1265611)
  * NIST SP 800-131Arev3 has marked SHA-224 and SHA3-224 as legacy
    after the deadline of 31 dic 2030.
  * Add gnutls-FIPS-SHA224-SHA3224-Legacy-Status.patch
- FIPS: Deprecate HMAC with keys less than 128-bit (bsc#1265610)
  * NIST SP 800-131Arev3 marked HMAC with keys less than 128-bits
    as disallowed after the deadline of 31 dic 2030.
  * Add gnutls-FIPS-Deprecate-HMAC-with-less-that-128-bit-keys.patch
- FIPS: Deprecate RSA Signatures with less than 128-bit (bsc#1265612)
  * NIST SP 800-131Arev3 has marked RSA Signatures with less than
    128-bit as deprecated after the deadline of 31 dic 2030.
  * Add gnutls-FIPS-Deprecate-RSAsig-with-less-that-128-bit.patch

==== gzip ====

- Fix CVE-2026-41992, global buffer overflow in the LZH decompression logic
  (CVE-2026-41992, bsc#1269623, bsc#1272554)
  * CVE-2026-41992.patch
- Refresh patches to apply with -p1:
  * non-exec-stack.diff
  * zdiff.diff
  * zgrep.diff
- Use %autosetup to apply patches

==== libalternatives ====
Version update (1.2+31.da24cd4 -> 2.0+0.4f22c01)
Subpackages: alts libalternatives1

- Update to version v2.0+0.4f22c01:
  * add missing test
  * Capture saved_errno correctly
  * Check for null pointer
  * reset argv0 to original if execve() fails
  * Clarify value of argv0
  * Return errno from failed exec()
  * Use basename for argv[0] resolution
  * Update unit test
  * Document behaviour changes - KeepArgv0 is default
  * Correct pointer in corner case
  * Add UpdateArgv0 option
  * Clarify priority as increasing with integer size
- Functionality change: KeepArgv0 is default option unless
  another is specified. Functionality should now be same as with
  symlinks (bsc#1262785)

==== libgit2 ====
Version update (1.9.6 -> 1.9.7)

- update to 1.9.7:
  * CVE-2026-5917: Escape remote repository paths in libssh2
    (boo#1274971)

==== librist ====

- Switch from mbedtls to gnutls

==== libssh ====
Subpackages: libssh-config libssh4

- Fix libssh ignores system wide crypto policies (bsc#1272547)
  * Add patch: libssh-cmake-Add-option-WITH_HERMETIC_USR.patch

==== libupnp ====
Version update (22.0.4 -> 22.0.6)
Subpackages: libixml22 libupnp22

- Update to release 22.0.6
  * Build fixes for OmniOS

==== ovmf ====
Subpackages: qemu-ovmf-x86_64

- Remove ovmf-UefiCpuPkg-Disable-EFI-memory-attributes-protocol.patch (bsc#1240771)
  because GRUB2 already supports the EFI Memory Attributes Protocol.

==== publicsuffix ====
Version update (20260708 -> 20260725)

- Update to version 20260725:
  * Remove Acorn Labs on-acorn.io entries from public_suffix_list.dat (#3093)
  * util: gTLD data autopull updates for 2026-07-24T16:40:16 UTC (#3090)
  * Add playcode.site to PRIVATE section (#3072)
  * Remove deta.dev, deta.app entries from public_suffix_list.dat (#3066)
  * Add a workflow that checks the PR template is filled out (#3077)
  * Remove onfabrica.com Fabrica Technologies entry (#3065)
  * Remove Bytemark Hosting entries: uk0.bigv.io dh.bytemark.co.uk vm.bytemark.co.uk (#3053)
  * Update `.it` (#3049)
  * Remove cryptonomic.net Cryptonomic entries from public_suffix_list.dat (#3050)
  * Remove api.stdlib.com from public suffix list (#3051)
  * Remove hzc.io RethinkDB entries from public_suffix_list.dat (#3052)
  * AI Agent notice about not modifying the repo PR template (#3043)
  * Delete protonet.io and Protonet GmbH entry (#3048)
  * Remove Storj Labs entries from public_suffix_list.dat (#3063)
  * util: gTLD data autopull updates for 2026-07-15T16:20:56 UTC (#3042)
  * remove ac.tj from public_suffix_list.dat (#3001)
  * Adding aero.in, alumni.in, school.in and ub.in (#2988)
  * Update `.no` (#3029)
  * Add cyb.ge, llc.ge, online.ge and tnx.ge (#2963)
  * Add mygov.scot (#2900)
  * Add IPv64.net dynamic DNS domains (#3009)

==== python-h2 ====
Version update (4.3.0 -> 4.4.1)

- Update to 4.4.1 (fixes CVE-2026-71554, bsc#1274386)
  * Performance improvement: remove consumed frames in-place from data buffer.
  * Reject duplicate Host headers in request headers. Thanks to Sunand Mohan
    for the report.
- Update to 4.4.0
  * Support for Python 3.9 has been removed.
  * Support for PyPy 3.9 has been removed.
  * Stream.end_stream() now raises NoSuchStreamError or StreamClosedError
    exceptions, instead of a generic KeyError.
  * Duplicate content-length headers with different values now raise
    ProtocolError. Previously, the first content-length header was accepted
    and later conflicting values were ignored. Thanks to Harshal Parekh for
    the report.
  * Parse content-length headers according to RFC9110 grammar for numbers
    (1*DIGIT). Thanks to Arkadiusz Marta for the report.
  * backfill from v4.3.0 Convert emitted events into Python dataclass, which
    introduces new constructors with required arguments. Instantiating these
    events without arguments, as previously commonly used API pattern, will no
    longer work.
  * Support for Python 3.14 has been added.
  * H2Connection.receive_data now accepts any byte-like object that implements
    the buffer protocol, such as bytes, bytearray, and memoryview. Existing
    bytes callers are unaffected.
  * Align CONNECT pseudo-header validation with RFC 9113 s8.3 and RFC 8441 s4.
    Ordinary CONNECT now requires :method=CONNECT and :authority, and forbids
    :scheme/:path. Extended CONNECT (e.g., WebSocket) requires :scheme, :path,
    :authority plus :protocol.
  * Fix incorrect substring matching of secure header in cookie and :method.
  * Fix to allow sending 0 bytes on a stream even if the flow control window is
    negative.
  * Reject non-zero SETTINGS_ENABLE_PUSH values received from servers.

==== qt6-base ====
Subpackages: libQt6Concurrent6 libQt6Core6 libQt6DBus6 libQt6Gui6 libQt6Network6 libQt6OpenGL6 libQt6OpenGLWidgets6 libQt6PrintSupport6 libQt6Sql6 libQt6Test6 libQt6WaylandClient6 libQt6Widgets6 libQt6WlShellIntegration6 libQt6Xml6 qt6-network-tls qt6-networkinformation-connman qt6-networkinformation-glib qt6-networkinformation-nm qt6-platformtheme-gtk3 qt6-printsupport-cups qt6-sql-mysql qt6-sql-sqlite qt6-wayland

- Add patch to fix incomplete docs (QTBUG-149045):
  * 0001-CMake-Handle-generated-headers-in-syncqt-scan-all-mo.patch

==== vim ====
Version update (9.2.0780 -> 9.2.0901)
Subpackages: vim-data vim-data-common xxd

- gvim.desktop: Remove deprecated values
- Update to 9.2.0901:
  9.2.0781: tests: Test_fuzzy_completion_bufname_fullpath() creates unnecessary dir
  9.2.0782: tests: missing cleanup in test_mksession.vim
  9.2.0783: tests: personal spell files leak into later tests
  9.2.0784: crash when borrowing statusline highlight in silent Ex mode
  9.2.0785: WinResized not triggered when the whole Vim is resized
  9.2.0786: filetype: Containerfile is not recognized
  9.2.0787: regexp: code 0x1ecb duplicated for equivalence class
  9.2.0788: filetype: hip files are not recognized
  9.2.0789: 'statuslineopt' status line too high after a window is minimized
  9.2.0790: 'completeslash' breaks :find completion with 'findfunc'
  9.2.0791: wincol() counts from right side for 'rightleft'
  9.2.0792: runtime(netrw): Explore without optional dir broken
  9.2.0793: If session restored a tiny window, restore fails
  9.2.0794: extend() and extendnew() don't handle NULL expr2 properly
  9.2.0795: popup menu shadow is not cleared when the menu shrinks
  9.2.0796: Visual block reselection wrong with 'virtualedit'
  9.2.0797: Memory leak in get_qfline_items() on alloc failure
  9.2.0798: Memory leak in compile_expr6() on alloc failure
  9.2.0799: Memory leak in compile_def_function_body() on alloc failure
  9.2.0800: Memory leak in call_func() on alloc failure
  9.2.0801: Memory leak in f_getreginfo() on alloc failure
  9.2.0802: Memory leak with list_append_dict/dict_add_list on alloc failure
  9.2.0803: Memory leak on alloc failure with taglist/gettagstack()
  9.2.0804: wincol() is wrong for a double-wide character with 'rightleft'
  9.2.0805: screenpos() "curscol" is wrong with 'rightleft'
  9.2.0806: 'showcmd' may show internal command keys
  9.2.0807: MS-Windows: ellipsis character is garbled
  9.2.0808: getregionpos: double-free on alloc failure
  9.2.0809: getframelayout() uses wrong function to free lists
  9.2.0810: add_llist_tags() uses wrong function to free dict
  9.2.0811: mksession writes terminal command unquoted
  9.2.0812: :argdelete with pattern leads to wrong argidx()
  9.2.0813: dict_add_func() may corrupt funcref count on failure
  9.2.0814: Vim9: E1041 when reloading an autoload script with exported variables
  9.2.0815: deeply nested regexp patterns may cause stack overflow
  9.2.0816: GTK4: Memory leak in gui_gtk_set_dnd_targets()
  9.2.0817: crash when building a stacktrace during an autocommand
  9.2.0818: tests: client-server test fails without X11 server
  9.2.0819: MS-Windows: sixel image shown as raw text in the console
  9.2.0820: GUI: hidden popup image is displayed and not erased
  9.2.0821: filetype: msmtp system-wide rc file not detected
  9.2.0822: GTK4: crash menu id is null in gui_mch_destroy_menu()
  9.2.0823: tests: Test_clientserver_servlist_list may fail
  9.2.0824: Makefile: Make tags depends on configure
  9.2.0825: regexp: submatch in a look-behind is empty with the NFA engine
  9.2.0826: highlighting for broken terminals can be improved
  9.2.0827: :startinsert enters Insert mode in a non-modifiable buffer
  9.2.0828: GTK4: hardware rendering can be improved
  9.2.0829: Sessions do not preserve script version for expression options
  9.2.0830: the completion menu is not used on terminals without colors
  9.2.0831: diff highlighting hard to read with syntax enabled
  9.2.0832: socketserver: remote commands can be processed in reverse order
  9.2.0833: GTK4: menu mnemonics do not work properly
  9.2.0834: cleared last search pattern is restored from viminfo
  9.2.0835: features in version.c are not sorted
  9.2.0836: filetype: .git-blame-ignore-revs file is not recognized
  9.2.0837: Using wrong colors in hl_blend_attr()
  9.2.0838: searchcount() returns wrong cached maxcount
  9.2.0839: [security]: arbitrary code execution via keyword lookup
  9.2.0840: [security]: code injection in netrw via bookmarks
  9.2.0841: [security]: heap overflow when adding > 65535 text properties
  9.2.0842: [security]: stack buffer overflow in socket server
  9.2.0843: [security]: popup: opacity mask indexed out of bounds
  9.2.0844: [security]: use-after-free on json decode error
  9.2.0845: [security]: arbitrary Ex command execution during C omni-completion
  9.2.0846: [security]: heap buffer overflow in set_sofo()
  9.2.0847: [security]: vimball: code execution via .VimballRecord file
  9.2.0848: tagfunc "cmd" with a generic Ex command corrupts the tag entry
  9.2.0849: filetype: osquery config files are not recognized
  9.2.0850: MS-Windows: commands from a client can be lost
  9.2.0851: Focus autocommands triggered inconsistently
  9.2.0852: GTK: ligatures not correctly displayed
  9.2.0853: popup: popup images do not support scaling
  9.2.0854: memory leak when reading a spell file with SN_SAL and SN_SOFO
  9.2.0855: 'showcmd' not redrawn with empty mapping triggered on timeout
  9.2.0856: GTK4: undercurl rendering is inefficient
  9.2.0857: popup: opacity popup over a terminal is not cleared when closed
  9.2.0858: MS-Windows GUI: white flash when VimEnter is slow
  9.2.0859: GTK2: Link error
  9.2.0860: filetype: xilinx design constraint files are not recognized
  9.2.0861: GTK4: bleed region updates in jumps
  9.2.0862: Missing test change from v9.2.0857
  9.2.0863: MS-Windows GUI: window contents can be missing when VimEnter is slow
  9.2.0864: Using some dead code in Wayland feature
  9.2.0865: GTK4: non-hardware accelerated UI is too slow
  9.2.0866: MS-Windows: ":language messages" only works once
  9.2.0867: MS-Windows: messages are not in the display language
  9.2.0868: GTK: Window Manager hint prevents giving focus to dialog
  9.2.0869: buf_copy_options() can lose the P_INSECURE flag
  9.2.0870: filetype: marko files are not recognized
  9.2.0871: screen line is lost when splitting a 'winfixheight' window
  9.2.0872: popup with opacity does not use the font of the highlight group
  9.2.0873: :redrawstatus does not update the ruler of the last window
  9.2.0874: fold size is compared against 'foldminlines' of the wrong window
  9.2.0875: GTK4: GUI does not support command-line arguments
  9.2.0876: GTK4: compile error with disabled netbeans feat
  9.2.0877: Vim9: crash when a closure assigns to a variable declared in a loop
    ... changelog too long, skipping 24 lines ...
  9.2.0901: textprop: wrong cursor line with truncated virtual text

==== wget ====
Subpackages: wget-lang

- Fix segmentation fault in metalink4, bsc#1273449
  * Fix-segfault-in-retrieve_from_metalink-when-a-metalink.patch

==== yast2-storage-ng ====
Version update (5.0.49 -> 5.0.50)

- Fix automatic generation of crypt names (bsc#1247173).
- 5.0.50

==== yelp ====
Version update (49.1+3 -> 49.2)
Subpackages: libyelp-1-0 yelp-lang

- Update to version 49.2:
  + Fixed build issue caused by direct inclusion of a GDK header
  + Fixed typo in the metainfo data
  + Fixed compiler warning caused by unused return value
  + Removed a duplicate key in the Flatpak manifest
  + Updated translations.