<?xml version="1.0" encoding="UTF-8"?>
<otherdata xmlns="http://linux.duke.edu/metadata/other" packages="5">
<package pkgid="6f523a6d878b6837f028c05b0817b7dd0901d435e5e51ea962dd7fa45e4b4853" name="venv-salt-minion" arch="aarch64">
  <version epoch="0" ver="3006.0" rel="35.1"/>
  <changelog author="vzhestkov@suse.com" date="1773403200">- Add x86_64_v2 as a possible rpm package architecture
- Make users with backslash working for salt-ssh (bsc#1254629)
- Fix ansible.playbooks extra-vars quoting (bsc#1257831)
- Fix virtualenv call in test helper to use proper python version
- Added:
  * add-x86_64_v2-as-a-possible-rpm-package-architecture.patch
  * make-users-with-backslash-working-for-salt-ssh-bsc-1.patch
  * fix-ansible.playbooks-extra-vars-quoting-bsc-1257831.patch
  * fix-virtualenv-call-in-test-helper-to-use-proper-pyt.patch</changelog>
  <changelog author="vzhestkov@suse.com" date="1773748800">- Backport security patch for Salt vendored tornado (bsc#1259554):
  * CVE-2026-31958: Add limits on multipart form data parsing
- Added:
  * backport-of-the-cve-2026-31958-fix-bsc-1259554.patch</changelog>
  <changelog author="marek.czernek@suse.com" date="1776168000">- Fix testsuite failures
- Added:
  * fix-test-failures-754.patch</changelog>
  <changelog author="marek.czernek@suse.com" date="1777291200">- BDSA-2025-60810: Harden Tornado from invalid HTTP reason phrases
- Read full URI from ldap pillar config (bsc#1254900)
- Added:
  * bdsa-2025-60810-harden-against-invalid-http-reason-p.patch
  * read-full-uri-from-ldap-pillar-config-753.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1778155200">- Specify .SO ver explicitly in BuildRequire for libsodium</changelog>
  <changelog author="vzhestkov@suse.com" date="1778760000">- Use non vendored tornado with Python 3.11 (bsc#1257583, bsc#1259700)
- Added:
  * use-non-vendored-tornado-with-python-3.11.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1779451200">- Add 'show_changes' arg to 'file.append/file.prepend" states
- Added:
  * add-show_changes-to-file.append-and-file.prepend-sta.patch</changelog>
  <changelog author="yeray.gutierrez@suse.com" date="1780488000">- Calculate UUID grain for Xen PV guests (bsc#1255418)
- Added:
  * calculate-uuid-grain-for-xen-pv-guests-759.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1780920000">- Fix deprecation warnings when running on Python 3.13
- Added:
  * fix-deprecation-warnings-when-running-on-python-3.13.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1781092800">- Fix ImportError during reentrant SIGTERM shutdown
- Fix broken "pkg.info_installed" after migration to salt.utils.timeutil
- Added:
  * fix-importerror-during-reentrant-sigterm-shutdown.patch
  * fix-broken-pkg.info_installed-after-moving-to-salt.u.patch</changelog>
  <changelog author="vzhestkov@suse.com" date="1782216000">- Fix the tests failing after switching to non-vendored tornado
- Fix the default group in tests for new users in SLE 15.6
- Use AsyncHTTPClient in salt.utils.http (bsc#1268325)
- Fix file fetching with cp module on non-vendored tornado
- Decode binary pillars for salt-ssh to avoid exceptions (bsc#1263822)
- Added:
  * fix-the-tests-failing-after-switching-to-non-vendore.patch
  * fix-the-default-group-in-tests-for-new-users-in-sle-.patch
  * use-asynchttpclient-in-salt.utils.http-bsc-1268325.patch
  * fix-file-fetching-with-non-vendored-tornado.patch
  * decode-binary-pillars-for-salt-ssh-to-avoid-exceptio.patch</changelog>
  <changelog author="vzhestkov@suse.com" date="1782820800">- Bundled python module OpenSSL was updated with CVE fix:
  * CVE-2026-40475: improper input handling of null bytes
    can lead to silent data truncation and security-state
    inconsistency (bsc#1262803)</changelog>
  <changelog author="vzhestkov@suse.com" date="1783080000">- Bundled python module tornado was updated with CVE fixes:
  * CVE-2026-49853: authorization header forwarded across
    cross-origin redirects in SimpleAsyncHTTPClient (bsc#1268395)
  * CVE-2026-49854: out-of-bounds memory access via C extension
    (bsc#1268396)
  * CVE-2026-49855: AsyncHTTPClient accumulates decompressed chunks
    without size limit (gzip bomb) (bsc#1268397)</changelog>
  <changelog author="marek.czernek@suse.com" date="1784116800">- Stabilize testsuite tests and fix AllEventsHandler
- Switch apache2ctl to apachectl for SUSE OSes (bsc#1252286)
- Support attrlist in ldap.managed (bsc#1257151)
- Added:
  * stabilize-testsuite-tests-and-fix-alleventshandler-7.patch
  * switch-apache2ctl-to-apachectl-for-suse-oses-bsc-125.patch
  * support-attrlist-in-ldap.managed-746.patch</changelog>
  <changelog author="vzhestkov@suse.com" date="1785240000">- Bundled python module jinja2 was updated to 3.1.6 with CVE fixes:
  * CVE-2024-22195: Fix compiler error when checking if required
    blocks in parent templates are xmlattr filter does not allow
    keys with spaces. (bsc#1218722)
- Bundled python module idna was updated with CVE fix:
  * CVE-2026-45409: Specially crafted inputs to idna.encode()
    can bypass earlier security fix (bsc#1265413)
- Bundled python module urllib3 was updated with CVE fix:
  * CVE-2026-44431: sensitive information disclosure due to
    sensitive headers being forwarded across origins in proxied
    low-level redirects (bsc#1265267)
- Bundled python module lxml was updated to 6.1.1 with CVE fixes:
  * CVE-2026-49825: The known link attributes in
    ``lxml.html.defs.link_attrs`` were missing ``xlink:href``,
    which can be used for URL bypass attacks in embedded
    SVG/MathML/etc. content. (bsc#1270285, CVE-2026-49825)
    https://github.com/fedora-python/lxml_html_clean/security/
    advisories/GHSA-4jhm-jv67-739f
  * CVE-2026-41066: This release fixes a possible external entity
    injection (XXE) vulnerability in ``iterparse()`` and
    the ``ETCompatXMLParser``. (bsc#1263254, CVE-2026-41066)
- Bundled python was updated with CVE fixes:
  * CVE-2026-3446: Preventing ignoring excess Base64 data
    after the first padded quad in non-strict (default) mode.
    (bsc#1261970, CVE-2026-3446, gh#python/cpython#145264).
  * CVE-2026-3479: pkgutil.get_data() has the same security model
    as open(). The documented limitations ensure compatibility with
    non-filesystem loaders; Python doesn't check that.
    (bsc#1259989, CVE-2026-3479, gh#python/cpython#146121).
- Bundled python module pyopenssl contains CVE fixes:
  * CVE-2026-27459: large cookie value can lead to a buffer overflow
    (bsc#1271428, CVE-2026-27459)
- Remove unused paramiko python module from the bundle.
- Cleanup commented packages in include-rpm and include-deb
- Modified:
  * include-deb
  * include-rpm</changelog>
  <changelog author="marek.czernek@suse.com" date="1785326400">- Fix unit tests that fail due to async Tornado usage
- Added:
  * stabilize-testsuite-773.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1785412800">- Prevent broken Salt Bundle on Ubuntu due regression in "tar" package
  from Ubuntu repositories (bsc#1271613)</changelog>
  <changelog author="vzhestkov@suse.com" date="1786017600">- Bundled python was updated with CVE fixes:
  * CVE-2026-13346: Arbitrary file installation via malicious package
    indexes. Remove ensurepip with bundled .whl files. (bsc#1273094)
  * CVE-2026-0864: Normalize all line endings (CR, CRLF, and LF) in
    configparser (bsc#1269066, gh#python/cpython#143927)
  * CVE-2026-1502: reject CR/LF in HTTP tunnel request headers
    (bsc#1261969, gh#python/cpython#146211)
  * CVE-2026-3276: Fix O(n^2) canonical ordering in
    unicodedata.normalize() (bsc#1267581, gh#python/cpython#149079)
  * CVE-2026-4360: Pass filter_function to TarFile._extract_one()
    during .extract() (bsc#1269959, gh#python/cpython#151987)
  * CVE-2026-4786: fix webbrowser %action substitution bypass of
    dash-prefix check (bsc#1262319, gh#python/cpython#148169)
  * CVE-2026-6019: protect against HTML injection by
    Base64-encoding cookie values embedded in JS
    (bsc#1262654, gh#python/cpython#90309)
  * CVE-2026-6100: prevent dangling pointer, which can end in the
    use-after-free error (bsc#1262098, gh#python/cpython#148395)
  * CVE-2026-7210: Use XML_SetHashSalt16Bytes in
    pyexpat/_elementtree when possible
    (bsc#1264962, gh#python/cpython#149018).
  * CVE-2026-7774: tarfile.data_filter: validate written link
    target (bsc#1267821, gh#149486)
  * CVE-2026-8328: Make ftplib not trust the PASV response
    (bsc#1265268)
  * CVE-2026-11940: fix the symlink escape via tarfile
    hardlink-extraction fallback (bsc#1268977)
  * CVE-2026-11972: Make tarfile._Stream.seek break at EOF
    (bsc#1269788, gh#python/cpython#151981)
  * CVE-2026-15308: Fix quadratic complexity in incremental parsing
    in HTMLParser (bsc#1271192, gh#python/cpython#153030)
- Bundled python module pip was updated to 25.0.1 with CVE fixes:
  * CVE-2026-13346: Arbitrary file installation via malicious package
    indexes (bsc#1273094)
  * CVE-2026-8643: Path traversal via malicious entry point name in pip
    wheel installation allows arbitrary file overwrite(bsc#1266669)
  * CVE-2026-6357: pip self-update functionality can import newly
    installed modules after wheel installation (bsc#1263442)
  * CVE-2026-3219: pip doesn't reject concatenated ZIP (bsc#1262429)
  * CVE-2026-1703: files may be extracted outside the installation
    directory when installing and extracting maliciously crafted
    wheel archives (bsc#1257599, gh#pypa/pip#13777)</changelog>
  <changelog author="marek.czernek@suse.com" date="1786449600">- Fix test failures with pytest&gt;=8
- Added:
  * migrate-rest_tornado-saltnado-tests-to-pytest-774.patch</changelog>
  <changelog author="marek.czernek@suse.com" date="1787918400">- Stop packaging tomli and exceptiongroup in the testsuite, as
  pytest&gt;=8 no longer requires them
- Modified:
  * include-deb
  * include-rpm</changelog>
</package>
<package pkgid="8262a49eb605e87cc510bcf2ba0c2ef7642af5f61c3b431d548e178a18ac80b7" name="venv-salt-minion" arch="ppc64le">
  <version epoch="0" ver="3006.0" rel="35.1"/>
  <changelog author="vzhestkov@suse.com" date="1773403200">- Add x86_64_v2 as a possible rpm package architecture
- Make users with backslash working for salt-ssh (bsc#1254629)
- Fix ansible.playbooks extra-vars quoting (bsc#1257831)
- Fix virtualenv call in test helper to use proper python version
- Added:
  * add-x86_64_v2-as-a-possible-rpm-package-architecture.patch
  * make-users-with-backslash-working-for-salt-ssh-bsc-1.patch
  * fix-ansible.playbooks-extra-vars-quoting-bsc-1257831.patch
  * fix-virtualenv-call-in-test-helper-to-use-proper-pyt.patch</changelog>
  <changelog author="vzhestkov@suse.com" date="1773748800">- Backport security patch for Salt vendored tornado (bsc#1259554):
  * CVE-2026-31958: Add limits on multipart form data parsing
- Added:
  * backport-of-the-cve-2026-31958-fix-bsc-1259554.patch</changelog>
  <changelog author="marek.czernek@suse.com" date="1776168000">- Fix testsuite failures
- Added:
  * fix-test-failures-754.patch</changelog>
  <changelog author="marek.czernek@suse.com" date="1777291200">- BDSA-2025-60810: Harden Tornado from invalid HTTP reason phrases
- Read full URI from ldap pillar config (bsc#1254900)
- Added:
  * bdsa-2025-60810-harden-against-invalid-http-reason-p.patch
  * read-full-uri-from-ldap-pillar-config-753.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1778155200">- Specify .SO ver explicitly in BuildRequire for libsodium</changelog>
  <changelog author="vzhestkov@suse.com" date="1778760000">- Use non vendored tornado with Python 3.11 (bsc#1257583, bsc#1259700)
- Added:
  * use-non-vendored-tornado-with-python-3.11.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1779451200">- Add 'show_changes' arg to 'file.append/file.prepend" states
- Added:
  * add-show_changes-to-file.append-and-file.prepend-sta.patch</changelog>
  <changelog author="yeray.gutierrez@suse.com" date="1780488000">- Calculate UUID grain for Xen PV guests (bsc#1255418)
- Added:
  * calculate-uuid-grain-for-xen-pv-guests-759.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1780920000">- Fix deprecation warnings when running on Python 3.13
- Added:
  * fix-deprecation-warnings-when-running-on-python-3.13.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1781092800">- Fix ImportError during reentrant SIGTERM shutdown
- Fix broken "pkg.info_installed" after migration to salt.utils.timeutil
- Added:
  * fix-importerror-during-reentrant-sigterm-shutdown.patch
  * fix-broken-pkg.info_installed-after-moving-to-salt.u.patch</changelog>
  <changelog author="vzhestkov@suse.com" date="1782216000">- Fix the tests failing after switching to non-vendored tornado
- Fix the default group in tests for new users in SLE 15.6
- Use AsyncHTTPClient in salt.utils.http (bsc#1268325)
- Fix file fetching with cp module on non-vendored tornado
- Decode binary pillars for salt-ssh to avoid exceptions (bsc#1263822)
- Added:
  * fix-the-tests-failing-after-switching-to-non-vendore.patch
  * fix-the-default-group-in-tests-for-new-users-in-sle-.patch
  * use-asynchttpclient-in-salt.utils.http-bsc-1268325.patch
  * fix-file-fetching-with-non-vendored-tornado.patch
  * decode-binary-pillars-for-salt-ssh-to-avoid-exceptio.patch</changelog>
  <changelog author="vzhestkov@suse.com" date="1782820800">- Bundled python module OpenSSL was updated with CVE fix:
  * CVE-2026-40475: improper input handling of null bytes
    can lead to silent data truncation and security-state
    inconsistency (bsc#1262803)</changelog>
  <changelog author="vzhestkov@suse.com" date="1783080000">- Bundled python module tornado was updated with CVE fixes:
  * CVE-2026-49853: authorization header forwarded across
    cross-origin redirects in SimpleAsyncHTTPClient (bsc#1268395)
  * CVE-2026-49854: out-of-bounds memory access via C extension
    (bsc#1268396)
  * CVE-2026-49855: AsyncHTTPClient accumulates decompressed chunks
    without size limit (gzip bomb) (bsc#1268397)</changelog>
  <changelog author="marek.czernek@suse.com" date="1784116800">- Stabilize testsuite tests and fix AllEventsHandler
- Switch apache2ctl to apachectl for SUSE OSes (bsc#1252286)
- Support attrlist in ldap.managed (bsc#1257151)
- Added:
  * stabilize-testsuite-tests-and-fix-alleventshandler-7.patch
  * switch-apache2ctl-to-apachectl-for-suse-oses-bsc-125.patch
  * support-attrlist-in-ldap.managed-746.patch</changelog>
  <changelog author="vzhestkov@suse.com" date="1785240000">- Bundled python module jinja2 was updated to 3.1.6 with CVE fixes:
  * CVE-2024-22195: Fix compiler error when checking if required
    blocks in parent templates are xmlattr filter does not allow
    keys with spaces. (bsc#1218722)
- Bundled python module idna was updated with CVE fix:
  * CVE-2026-45409: Specially crafted inputs to idna.encode()
    can bypass earlier security fix (bsc#1265413)
- Bundled python module urllib3 was updated with CVE fix:
  * CVE-2026-44431: sensitive information disclosure due to
    sensitive headers being forwarded across origins in proxied
    low-level redirects (bsc#1265267)
- Bundled python module lxml was updated to 6.1.1 with CVE fixes:
  * CVE-2026-49825: The known link attributes in
    ``lxml.html.defs.link_attrs`` were missing ``xlink:href``,
    which can be used for URL bypass attacks in embedded
    SVG/MathML/etc. content. (bsc#1270285, CVE-2026-49825)
    https://github.com/fedora-python/lxml_html_clean/security/
    advisories/GHSA-4jhm-jv67-739f
  * CVE-2026-41066: This release fixes a possible external entity
    injection (XXE) vulnerability in ``iterparse()`` and
    the ``ETCompatXMLParser``. (bsc#1263254, CVE-2026-41066)
- Bundled python was updated with CVE fixes:
  * CVE-2026-3446: Preventing ignoring excess Base64 data
    after the first padded quad in non-strict (default) mode.
    (bsc#1261970, CVE-2026-3446, gh#python/cpython#145264).
  * CVE-2026-3479: pkgutil.get_data() has the same security model
    as open(). The documented limitations ensure compatibility with
    non-filesystem loaders; Python doesn't check that.
    (bsc#1259989, CVE-2026-3479, gh#python/cpython#146121).
- Bundled python module pyopenssl contains CVE fixes:
  * CVE-2026-27459: large cookie value can lead to a buffer overflow
    (bsc#1271428, CVE-2026-27459)
- Remove unused paramiko python module from the bundle.
- Cleanup commented packages in include-rpm and include-deb
- Modified:
  * include-deb
  * include-rpm</changelog>
  <changelog author="marek.czernek@suse.com" date="1785326400">- Fix unit tests that fail due to async Tornado usage
- Added:
  * stabilize-testsuite-773.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1785412800">- Prevent broken Salt Bundle on Ubuntu due regression in "tar" package
  from Ubuntu repositories (bsc#1271613)</changelog>
  <changelog author="vzhestkov@suse.com" date="1786017600">- Bundled python was updated with CVE fixes:
  * CVE-2026-13346: Arbitrary file installation via malicious package
    indexes. Remove ensurepip with bundled .whl files. (bsc#1273094)
  * CVE-2026-0864: Normalize all line endings (CR, CRLF, and LF) in
    configparser (bsc#1269066, gh#python/cpython#143927)
  * CVE-2026-1502: reject CR/LF in HTTP tunnel request headers
    (bsc#1261969, gh#python/cpython#146211)
  * CVE-2026-3276: Fix O(n^2) canonical ordering in
    unicodedata.normalize() (bsc#1267581, gh#python/cpython#149079)
  * CVE-2026-4360: Pass filter_function to TarFile._extract_one()
    during .extract() (bsc#1269959, gh#python/cpython#151987)
  * CVE-2026-4786: fix webbrowser %action substitution bypass of
    dash-prefix check (bsc#1262319, gh#python/cpython#148169)
  * CVE-2026-6019: protect against HTML injection by
    Base64-encoding cookie values embedded in JS
    (bsc#1262654, gh#python/cpython#90309)
  * CVE-2026-6100: prevent dangling pointer, which can end in the
    use-after-free error (bsc#1262098, gh#python/cpython#148395)
  * CVE-2026-7210: Use XML_SetHashSalt16Bytes in
    pyexpat/_elementtree when possible
    (bsc#1264962, gh#python/cpython#149018).
  * CVE-2026-7774: tarfile.data_filter: validate written link
    target (bsc#1267821, gh#149486)
  * CVE-2026-8328: Make ftplib not trust the PASV response
    (bsc#1265268)
  * CVE-2026-11940: fix the symlink escape via tarfile
    hardlink-extraction fallback (bsc#1268977)
  * CVE-2026-11972: Make tarfile._Stream.seek break at EOF
    (bsc#1269788, gh#python/cpython#151981)
  * CVE-2026-15308: Fix quadratic complexity in incremental parsing
    in HTMLParser (bsc#1271192, gh#python/cpython#153030)
- Bundled python module pip was updated to 25.0.1 with CVE fixes:
  * CVE-2026-13346: Arbitrary file installation via malicious package
    indexes (bsc#1273094)
  * CVE-2026-8643: Path traversal via malicious entry point name in pip
    wheel installation allows arbitrary file overwrite(bsc#1266669)
  * CVE-2026-6357: pip self-update functionality can import newly
    installed modules after wheel installation (bsc#1263442)
  * CVE-2026-3219: pip doesn't reject concatenated ZIP (bsc#1262429)
  * CVE-2026-1703: files may be extracted outside the installation
    directory when installing and extracting maliciously crafted
    wheel archives (bsc#1257599, gh#pypa/pip#13777)</changelog>
  <changelog author="marek.czernek@suse.com" date="1786449600">- Fix test failures with pytest&gt;=8
- Added:
  * migrate-rest_tornado-saltnado-tests-to-pytest-774.patch</changelog>
  <changelog author="marek.czernek@suse.com" date="1787918400">- Stop packaging tomli and exceptiongroup in the testsuite, as
  pytest&gt;=8 no longer requires them
- Modified:
  * include-deb
  * include-rpm</changelog>
</package>
<package pkgid="568a35a628e3bcec492b1ee809e9e4cc4bc09a569390fcf83efac08c609e6bd1" name="venv-salt-minion" arch="s390x">
  <version epoch="0" ver="3006.0" rel="35.1"/>
  <changelog author="vzhestkov@suse.com" date="1773403200">- Add x86_64_v2 as a possible rpm package architecture
- Make users with backslash working for salt-ssh (bsc#1254629)
- Fix ansible.playbooks extra-vars quoting (bsc#1257831)
- Fix virtualenv call in test helper to use proper python version
- Added:
  * add-x86_64_v2-as-a-possible-rpm-package-architecture.patch
  * make-users-with-backslash-working-for-salt-ssh-bsc-1.patch
  * fix-ansible.playbooks-extra-vars-quoting-bsc-1257831.patch
  * fix-virtualenv-call-in-test-helper-to-use-proper-pyt.patch</changelog>
  <changelog author="vzhestkov@suse.com" date="1773748800">- Backport security patch for Salt vendored tornado (bsc#1259554):
  * CVE-2026-31958: Add limits on multipart form data parsing
- Added:
  * backport-of-the-cve-2026-31958-fix-bsc-1259554.patch</changelog>
  <changelog author="marek.czernek@suse.com" date="1776168000">- Fix testsuite failures
- Added:
  * fix-test-failures-754.patch</changelog>
  <changelog author="marek.czernek@suse.com" date="1777291200">- BDSA-2025-60810: Harden Tornado from invalid HTTP reason phrases
- Read full URI from ldap pillar config (bsc#1254900)
- Added:
  * bdsa-2025-60810-harden-against-invalid-http-reason-p.patch
  * read-full-uri-from-ldap-pillar-config-753.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1778155200">- Specify .SO ver explicitly in BuildRequire for libsodium</changelog>
  <changelog author="vzhestkov@suse.com" date="1778760000">- Use non vendored tornado with Python 3.11 (bsc#1257583, bsc#1259700)
- Added:
  * use-non-vendored-tornado-with-python-3.11.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1779451200">- Add 'show_changes' arg to 'file.append/file.prepend" states
- Added:
  * add-show_changes-to-file.append-and-file.prepend-sta.patch</changelog>
  <changelog author="yeray.gutierrez@suse.com" date="1780488000">- Calculate UUID grain for Xen PV guests (bsc#1255418)
- Added:
  * calculate-uuid-grain-for-xen-pv-guests-759.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1780920000">- Fix deprecation warnings when running on Python 3.13
- Added:
  * fix-deprecation-warnings-when-running-on-python-3.13.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1781092800">- Fix ImportError during reentrant SIGTERM shutdown
- Fix broken "pkg.info_installed" after migration to salt.utils.timeutil
- Added:
  * fix-importerror-during-reentrant-sigterm-shutdown.patch
  * fix-broken-pkg.info_installed-after-moving-to-salt.u.patch</changelog>
  <changelog author="vzhestkov@suse.com" date="1782216000">- Fix the tests failing after switching to non-vendored tornado
- Fix the default group in tests for new users in SLE 15.6
- Use AsyncHTTPClient in salt.utils.http (bsc#1268325)
- Fix file fetching with cp module on non-vendored tornado
- Decode binary pillars for salt-ssh to avoid exceptions (bsc#1263822)
- Added:
  * fix-the-tests-failing-after-switching-to-non-vendore.patch
  * fix-the-default-group-in-tests-for-new-users-in-sle-.patch
  * use-asynchttpclient-in-salt.utils.http-bsc-1268325.patch
  * fix-file-fetching-with-non-vendored-tornado.patch
  * decode-binary-pillars-for-salt-ssh-to-avoid-exceptio.patch</changelog>
  <changelog author="vzhestkov@suse.com" date="1782820800">- Bundled python module OpenSSL was updated with CVE fix:
  * CVE-2026-40475: improper input handling of null bytes
    can lead to silent data truncation and security-state
    inconsistency (bsc#1262803)</changelog>
  <changelog author="vzhestkov@suse.com" date="1783080000">- Bundled python module tornado was updated with CVE fixes:
  * CVE-2026-49853: authorization header forwarded across
    cross-origin redirects in SimpleAsyncHTTPClient (bsc#1268395)
  * CVE-2026-49854: out-of-bounds memory access via C extension
    (bsc#1268396)
  * CVE-2026-49855: AsyncHTTPClient accumulates decompressed chunks
    without size limit (gzip bomb) (bsc#1268397)</changelog>
  <changelog author="marek.czernek@suse.com" date="1784116800">- Stabilize testsuite tests and fix AllEventsHandler
- Switch apache2ctl to apachectl for SUSE OSes (bsc#1252286)
- Support attrlist in ldap.managed (bsc#1257151)
- Added:
  * stabilize-testsuite-tests-and-fix-alleventshandler-7.patch
  * switch-apache2ctl-to-apachectl-for-suse-oses-bsc-125.patch
  * support-attrlist-in-ldap.managed-746.patch</changelog>
  <changelog author="vzhestkov@suse.com" date="1785240000">- Bundled python module jinja2 was updated to 3.1.6 with CVE fixes:
  * CVE-2024-22195: Fix compiler error when checking if required
    blocks in parent templates are xmlattr filter does not allow
    keys with spaces. (bsc#1218722)
- Bundled python module idna was updated with CVE fix:
  * CVE-2026-45409: Specially crafted inputs to idna.encode()
    can bypass earlier security fix (bsc#1265413)
- Bundled python module urllib3 was updated with CVE fix:
  * CVE-2026-44431: sensitive information disclosure due to
    sensitive headers being forwarded across origins in proxied
    low-level redirects (bsc#1265267)
- Bundled python module lxml was updated to 6.1.1 with CVE fixes:
  * CVE-2026-49825: The known link attributes in
    ``lxml.html.defs.link_attrs`` were missing ``xlink:href``,
    which can be used for URL bypass attacks in embedded
    SVG/MathML/etc. content. (bsc#1270285, CVE-2026-49825)
    https://github.com/fedora-python/lxml_html_clean/security/
    advisories/GHSA-4jhm-jv67-739f
  * CVE-2026-41066: This release fixes a possible external entity
    injection (XXE) vulnerability in ``iterparse()`` and
    the ``ETCompatXMLParser``. (bsc#1263254, CVE-2026-41066)
- Bundled python was updated with CVE fixes:
  * CVE-2026-3446: Preventing ignoring excess Base64 data
    after the first padded quad in non-strict (default) mode.
    (bsc#1261970, CVE-2026-3446, gh#python/cpython#145264).
  * CVE-2026-3479: pkgutil.get_data() has the same security model
    as open(). The documented limitations ensure compatibility with
    non-filesystem loaders; Python doesn't check that.
    (bsc#1259989, CVE-2026-3479, gh#python/cpython#146121).
- Bundled python module pyopenssl contains CVE fixes:
  * CVE-2026-27459: large cookie value can lead to a buffer overflow
    (bsc#1271428, CVE-2026-27459)
- Remove unused paramiko python module from the bundle.
- Cleanup commented packages in include-rpm and include-deb
- Modified:
  * include-deb
  * include-rpm</changelog>
  <changelog author="marek.czernek@suse.com" date="1785326400">- Fix unit tests that fail due to async Tornado usage
- Added:
  * stabilize-testsuite-773.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1785412800">- Prevent broken Salt Bundle on Ubuntu due regression in "tar" package
  from Ubuntu repositories (bsc#1271613)</changelog>
  <changelog author="vzhestkov@suse.com" date="1786017600">- Bundled python was updated with CVE fixes:
  * CVE-2026-13346: Arbitrary file installation via malicious package
    indexes. Remove ensurepip with bundled .whl files. (bsc#1273094)
  * CVE-2026-0864: Normalize all line endings (CR, CRLF, and LF) in
    configparser (bsc#1269066, gh#python/cpython#143927)
  * CVE-2026-1502: reject CR/LF in HTTP tunnel request headers
    (bsc#1261969, gh#python/cpython#146211)
  * CVE-2026-3276: Fix O(n^2) canonical ordering in
    unicodedata.normalize() (bsc#1267581, gh#python/cpython#149079)
  * CVE-2026-4360: Pass filter_function to TarFile._extract_one()
    during .extract() (bsc#1269959, gh#python/cpython#151987)
  * CVE-2026-4786: fix webbrowser %action substitution bypass of
    dash-prefix check (bsc#1262319, gh#python/cpython#148169)
  * CVE-2026-6019: protect against HTML injection by
    Base64-encoding cookie values embedded in JS
    (bsc#1262654, gh#python/cpython#90309)
  * CVE-2026-6100: prevent dangling pointer, which can end in the
    use-after-free error (bsc#1262098, gh#python/cpython#148395)
  * CVE-2026-7210: Use XML_SetHashSalt16Bytes in
    pyexpat/_elementtree when possible
    (bsc#1264962, gh#python/cpython#149018).
  * CVE-2026-7774: tarfile.data_filter: validate written link
    target (bsc#1267821, gh#149486)
  * CVE-2026-8328: Make ftplib not trust the PASV response
    (bsc#1265268)
  * CVE-2026-11940: fix the symlink escape via tarfile
    hardlink-extraction fallback (bsc#1268977)
  * CVE-2026-11972: Make tarfile._Stream.seek break at EOF
    (bsc#1269788, gh#python/cpython#151981)
  * CVE-2026-15308: Fix quadratic complexity in incremental parsing
    in HTMLParser (bsc#1271192, gh#python/cpython#153030)
- Bundled python module pip was updated to 25.0.1 with CVE fixes:
  * CVE-2026-13346: Arbitrary file installation via malicious package
    indexes (bsc#1273094)
  * CVE-2026-8643: Path traversal via malicious entry point name in pip
    wheel installation allows arbitrary file overwrite(bsc#1266669)
  * CVE-2026-6357: pip self-update functionality can import newly
    installed modules after wheel installation (bsc#1263442)
  * CVE-2026-3219: pip doesn't reject concatenated ZIP (bsc#1262429)
  * CVE-2026-1703: files may be extracted outside the installation
    directory when installing and extracting maliciously crafted
    wheel archives (bsc#1257599, gh#pypa/pip#13777)</changelog>
  <changelog author="marek.czernek@suse.com" date="1786449600">- Fix test failures with pytest&gt;=8
- Added:
  * migrate-rest_tornado-saltnado-tests-to-pytest-774.patch</changelog>
  <changelog author="marek.czernek@suse.com" date="1787918400">- Stop packaging tomli and exceptiongroup in the testsuite, as
  pytest&gt;=8 no longer requires them
- Modified:
  * include-deb
  * include-rpm</changelog>
</package>
<package pkgid="b0fd52c86bc1dbfba8a13b66f51f811984c15e6c67d657258a256657556474e4" name="venv-salt-minion" arch="src">
  <version epoch="0" ver="3006.0" rel="35.1"/>
  <changelog author="vzhestkov@suse.com" date="1773403200">- Add x86_64_v2 as a possible rpm package architecture
- Make users with backslash working for salt-ssh (bsc#1254629)
- Fix ansible.playbooks extra-vars quoting (bsc#1257831)
- Fix virtualenv call in test helper to use proper python version
- Added:
  * add-x86_64_v2-as-a-possible-rpm-package-architecture.patch
  * make-users-with-backslash-working-for-salt-ssh-bsc-1.patch
  * fix-ansible.playbooks-extra-vars-quoting-bsc-1257831.patch
  * fix-virtualenv-call-in-test-helper-to-use-proper-pyt.patch</changelog>
  <changelog author="vzhestkov@suse.com" date="1773748800">- Backport security patch for Salt vendored tornado (bsc#1259554):
  * CVE-2026-31958: Add limits on multipart form data parsing
- Added:
  * backport-of-the-cve-2026-31958-fix-bsc-1259554.patch</changelog>
  <changelog author="marek.czernek@suse.com" date="1776168000">- Fix testsuite failures
- Added:
  * fix-test-failures-754.patch</changelog>
  <changelog author="marek.czernek@suse.com" date="1777291200">- BDSA-2025-60810: Harden Tornado from invalid HTTP reason phrases
- Read full URI from ldap pillar config (bsc#1254900)
- Added:
  * bdsa-2025-60810-harden-against-invalid-http-reason-p.patch
  * read-full-uri-from-ldap-pillar-config-753.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1778155200">- Specify .SO ver explicitly in BuildRequire for libsodium</changelog>
  <changelog author="vzhestkov@suse.com" date="1778760000">- Use non vendored tornado with Python 3.11 (bsc#1257583, bsc#1259700)
- Added:
  * use-non-vendored-tornado-with-python-3.11.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1779451200">- Add 'show_changes' arg to 'file.append/file.prepend" states
- Added:
  * add-show_changes-to-file.append-and-file.prepend-sta.patch</changelog>
  <changelog author="yeray.gutierrez@suse.com" date="1780488000">- Calculate UUID grain for Xen PV guests (bsc#1255418)
- Added:
  * calculate-uuid-grain-for-xen-pv-guests-759.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1780920000">- Fix deprecation warnings when running on Python 3.13
- Added:
  * fix-deprecation-warnings-when-running-on-python-3.13.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1781092800">- Fix ImportError during reentrant SIGTERM shutdown
- Fix broken "pkg.info_installed" after migration to salt.utils.timeutil
- Added:
  * fix-importerror-during-reentrant-sigterm-shutdown.patch
  * fix-broken-pkg.info_installed-after-moving-to-salt.u.patch</changelog>
  <changelog author="vzhestkov@suse.com" date="1782216000">- Fix the tests failing after switching to non-vendored tornado
- Fix the default group in tests for new users in SLE 15.6
- Use AsyncHTTPClient in salt.utils.http (bsc#1268325)
- Fix file fetching with cp module on non-vendored tornado
- Decode binary pillars for salt-ssh to avoid exceptions (bsc#1263822)
- Added:
  * fix-the-tests-failing-after-switching-to-non-vendore.patch
  * fix-the-default-group-in-tests-for-new-users-in-sle-.patch
  * use-asynchttpclient-in-salt.utils.http-bsc-1268325.patch
  * fix-file-fetching-with-non-vendored-tornado.patch
  * decode-binary-pillars-for-salt-ssh-to-avoid-exceptio.patch</changelog>
  <changelog author="vzhestkov@suse.com" date="1782820800">- Bundled python module OpenSSL was updated with CVE fix:
  * CVE-2026-40475: improper input handling of null bytes
    can lead to silent data truncation and security-state
    inconsistency (bsc#1262803)</changelog>
  <changelog author="vzhestkov@suse.com" date="1783080000">- Bundled python module tornado was updated with CVE fixes:
  * CVE-2026-49853: authorization header forwarded across
    cross-origin redirects in SimpleAsyncHTTPClient (bsc#1268395)
  * CVE-2026-49854: out-of-bounds memory access via C extension
    (bsc#1268396)
  * CVE-2026-49855: AsyncHTTPClient accumulates decompressed chunks
    without size limit (gzip bomb) (bsc#1268397)</changelog>
  <changelog author="marek.czernek@suse.com" date="1784116800">- Stabilize testsuite tests and fix AllEventsHandler
- Switch apache2ctl to apachectl for SUSE OSes (bsc#1252286)
- Support attrlist in ldap.managed (bsc#1257151)
- Added:
  * stabilize-testsuite-tests-and-fix-alleventshandler-7.patch
  * switch-apache2ctl-to-apachectl-for-suse-oses-bsc-125.patch
  * support-attrlist-in-ldap.managed-746.patch</changelog>
  <changelog author="vzhestkov@suse.com" date="1785240000">- Bundled python module jinja2 was updated to 3.1.6 with CVE fixes:
  * CVE-2024-22195: Fix compiler error when checking if required
    blocks in parent templates are xmlattr filter does not allow
    keys with spaces. (bsc#1218722)
- Bundled python module idna was updated with CVE fix:
  * CVE-2026-45409: Specially crafted inputs to idna.encode()
    can bypass earlier security fix (bsc#1265413)
- Bundled python module urllib3 was updated with CVE fix:
  * CVE-2026-44431: sensitive information disclosure due to
    sensitive headers being forwarded across origins in proxied
    low-level redirects (bsc#1265267)
- Bundled python module lxml was updated to 6.1.1 with CVE fixes:
  * CVE-2026-49825: The known link attributes in
    ``lxml.html.defs.link_attrs`` were missing ``xlink:href``,
    which can be used for URL bypass attacks in embedded
    SVG/MathML/etc. content. (bsc#1270285, CVE-2026-49825)
    https://github.com/fedora-python/lxml_html_clean/security/
    advisories/GHSA-4jhm-jv67-739f
  * CVE-2026-41066: This release fixes a possible external entity
    injection (XXE) vulnerability in ``iterparse()`` and
    the ``ETCompatXMLParser``. (bsc#1263254, CVE-2026-41066)
- Bundled python was updated with CVE fixes:
  * CVE-2026-3446: Preventing ignoring excess Base64 data
    after the first padded quad in non-strict (default) mode.
    (bsc#1261970, CVE-2026-3446, gh#python/cpython#145264).
  * CVE-2026-3479: pkgutil.get_data() has the same security model
    as open(). The documented limitations ensure compatibility with
    non-filesystem loaders; Python doesn't check that.
    (bsc#1259989, CVE-2026-3479, gh#python/cpython#146121).
- Bundled python module pyopenssl contains CVE fixes:
  * CVE-2026-27459: large cookie value can lead to a buffer overflow
    (bsc#1271428, CVE-2026-27459)
- Remove unused paramiko python module from the bundle.
- Cleanup commented packages in include-rpm and include-deb
- Modified:
  * include-deb
  * include-rpm</changelog>
  <changelog author="marek.czernek@suse.com" date="1785326400">- Fix unit tests that fail due to async Tornado usage
- Added:
  * stabilize-testsuite-773.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1785412800">- Prevent broken Salt Bundle on Ubuntu due regression in "tar" package
  from Ubuntu repositories (bsc#1271613)</changelog>
  <changelog author="vzhestkov@suse.com" date="1786017600">- Bundled python was updated with CVE fixes:
  * CVE-2026-13346: Arbitrary file installation via malicious package
    indexes. Remove ensurepip with bundled .whl files. (bsc#1273094)
  * CVE-2026-0864: Normalize all line endings (CR, CRLF, and LF) in
    configparser (bsc#1269066, gh#python/cpython#143927)
  * CVE-2026-1502: reject CR/LF in HTTP tunnel request headers
    (bsc#1261969, gh#python/cpython#146211)
  * CVE-2026-3276: Fix O(n^2) canonical ordering in
    unicodedata.normalize() (bsc#1267581, gh#python/cpython#149079)
  * CVE-2026-4360: Pass filter_function to TarFile._extract_one()
    during .extract() (bsc#1269959, gh#python/cpython#151987)
  * CVE-2026-4786: fix webbrowser %action substitution bypass of
    dash-prefix check (bsc#1262319, gh#python/cpython#148169)
  * CVE-2026-6019: protect against HTML injection by
    Base64-encoding cookie values embedded in JS
    (bsc#1262654, gh#python/cpython#90309)
  * CVE-2026-6100: prevent dangling pointer, which can end in the
    use-after-free error (bsc#1262098, gh#python/cpython#148395)
  * CVE-2026-7210: Use XML_SetHashSalt16Bytes in
    pyexpat/_elementtree when possible
    (bsc#1264962, gh#python/cpython#149018).
  * CVE-2026-7774: tarfile.data_filter: validate written link
    target (bsc#1267821, gh#149486)
  * CVE-2026-8328: Make ftplib not trust the PASV response
    (bsc#1265268)
  * CVE-2026-11940: fix the symlink escape via tarfile
    hardlink-extraction fallback (bsc#1268977)
  * CVE-2026-11972: Make tarfile._Stream.seek break at EOF
    (bsc#1269788, gh#python/cpython#151981)
  * CVE-2026-15308: Fix quadratic complexity in incremental parsing
    in HTMLParser (bsc#1271192, gh#python/cpython#153030)
- Bundled python module pip was updated to 25.0.1 with CVE fixes:
  * CVE-2026-13346: Arbitrary file installation via malicious package
    indexes (bsc#1273094)
  * CVE-2026-8643: Path traversal via malicious entry point name in pip
    wheel installation allows arbitrary file overwrite(bsc#1266669)
  * CVE-2026-6357: pip self-update functionality can import newly
    installed modules after wheel installation (bsc#1263442)
  * CVE-2026-3219: pip doesn't reject concatenated ZIP (bsc#1262429)
  * CVE-2026-1703: files may be extracted outside the installation
    directory when installing and extracting maliciously crafted
    wheel archives (bsc#1257599, gh#pypa/pip#13777)</changelog>
  <changelog author="marek.czernek@suse.com" date="1786449600">- Fix test failures with pytest&gt;=8
- Added:
  * migrate-rest_tornado-saltnado-tests-to-pytest-774.patch</changelog>
  <changelog author="marek.czernek@suse.com" date="1787918400">- Stop packaging tomli and exceptiongroup in the testsuite, as
  pytest&gt;=8 no longer requires them
- Modified:
  * include-deb
  * include-rpm</changelog>
</package>
<package pkgid="7add562a6719272af09ebe1fbc4008fa84a944d8f04495423f18bd78606b448f" name="venv-salt-minion" arch="x86_64">
  <version epoch="0" ver="3006.0" rel="35.1"/>
  <changelog author="vzhestkov@suse.com" date="1773403200">- Add x86_64_v2 as a possible rpm package architecture
- Make users with backslash working for salt-ssh (bsc#1254629)
- Fix ansible.playbooks extra-vars quoting (bsc#1257831)
- Fix virtualenv call in test helper to use proper python version
- Added:
  * add-x86_64_v2-as-a-possible-rpm-package-architecture.patch
  * make-users-with-backslash-working-for-salt-ssh-bsc-1.patch
  * fix-ansible.playbooks-extra-vars-quoting-bsc-1257831.patch
  * fix-virtualenv-call-in-test-helper-to-use-proper-pyt.patch</changelog>
  <changelog author="vzhestkov@suse.com" date="1773748800">- Backport security patch for Salt vendored tornado (bsc#1259554):
  * CVE-2026-31958: Add limits on multipart form data parsing
- Added:
  * backport-of-the-cve-2026-31958-fix-bsc-1259554.patch</changelog>
  <changelog author="marek.czernek@suse.com" date="1776168000">- Fix testsuite failures
- Added:
  * fix-test-failures-754.patch</changelog>
  <changelog author="marek.czernek@suse.com" date="1777291200">- BDSA-2025-60810: Harden Tornado from invalid HTTP reason phrases
- Read full URI from ldap pillar config (bsc#1254900)
- Added:
  * bdsa-2025-60810-harden-against-invalid-http-reason-p.patch
  * read-full-uri-from-ldap-pillar-config-753.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1778155200">- Specify .SO ver explicitly in BuildRequire for libsodium</changelog>
  <changelog author="vzhestkov@suse.com" date="1778760000">- Use non vendored tornado with Python 3.11 (bsc#1257583, bsc#1259700)
- Added:
  * use-non-vendored-tornado-with-python-3.11.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1779451200">- Add 'show_changes' arg to 'file.append/file.prepend" states
- Added:
  * add-show_changes-to-file.append-and-file.prepend-sta.patch</changelog>
  <changelog author="yeray.gutierrez@suse.com" date="1780488000">- Calculate UUID grain for Xen PV guests (bsc#1255418)
- Added:
  * calculate-uuid-grain-for-xen-pv-guests-759.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1780920000">- Fix deprecation warnings when running on Python 3.13
- Added:
  * fix-deprecation-warnings-when-running-on-python-3.13.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1781092800">- Fix ImportError during reentrant SIGTERM shutdown
- Fix broken "pkg.info_installed" after migration to salt.utils.timeutil
- Added:
  * fix-importerror-during-reentrant-sigterm-shutdown.patch
  * fix-broken-pkg.info_installed-after-moving-to-salt.u.patch</changelog>
  <changelog author="vzhestkov@suse.com" date="1782216000">- Fix the tests failing after switching to non-vendored tornado
- Fix the default group in tests for new users in SLE 15.6
- Use AsyncHTTPClient in salt.utils.http (bsc#1268325)
- Fix file fetching with cp module on non-vendored tornado
- Decode binary pillars for salt-ssh to avoid exceptions (bsc#1263822)
- Added:
  * fix-the-tests-failing-after-switching-to-non-vendore.patch
  * fix-the-default-group-in-tests-for-new-users-in-sle-.patch
  * use-asynchttpclient-in-salt.utils.http-bsc-1268325.patch
  * fix-file-fetching-with-non-vendored-tornado.patch
  * decode-binary-pillars-for-salt-ssh-to-avoid-exceptio.patch</changelog>
  <changelog author="vzhestkov@suse.com" date="1782820800">- Bundled python module OpenSSL was updated with CVE fix:
  * CVE-2026-40475: improper input handling of null bytes
    can lead to silent data truncation and security-state
    inconsistency (bsc#1262803)</changelog>
  <changelog author="vzhestkov@suse.com" date="1783080000">- Bundled python module tornado was updated with CVE fixes:
  * CVE-2026-49853: authorization header forwarded across
    cross-origin redirects in SimpleAsyncHTTPClient (bsc#1268395)
  * CVE-2026-49854: out-of-bounds memory access via C extension
    (bsc#1268396)
  * CVE-2026-49855: AsyncHTTPClient accumulates decompressed chunks
    without size limit (gzip bomb) (bsc#1268397)</changelog>
  <changelog author="marek.czernek@suse.com" date="1784116800">- Stabilize testsuite tests and fix AllEventsHandler
- Switch apache2ctl to apachectl for SUSE OSes (bsc#1252286)
- Support attrlist in ldap.managed (bsc#1257151)
- Added:
  * stabilize-testsuite-tests-and-fix-alleventshandler-7.patch
  * switch-apache2ctl-to-apachectl-for-suse-oses-bsc-125.patch
  * support-attrlist-in-ldap.managed-746.patch</changelog>
  <changelog author="vzhestkov@suse.com" date="1785240000">- Bundled python module jinja2 was updated to 3.1.6 with CVE fixes:
  * CVE-2024-22195: Fix compiler error when checking if required
    blocks in parent templates are xmlattr filter does not allow
    keys with spaces. (bsc#1218722)
- Bundled python module idna was updated with CVE fix:
  * CVE-2026-45409: Specially crafted inputs to idna.encode()
    can bypass earlier security fix (bsc#1265413)
- Bundled python module urllib3 was updated with CVE fix:
  * CVE-2026-44431: sensitive information disclosure due to
    sensitive headers being forwarded across origins in proxied
    low-level redirects (bsc#1265267)
- Bundled python module lxml was updated to 6.1.1 with CVE fixes:
  * CVE-2026-49825: The known link attributes in
    ``lxml.html.defs.link_attrs`` were missing ``xlink:href``,
    which can be used for URL bypass attacks in embedded
    SVG/MathML/etc. content. (bsc#1270285, CVE-2026-49825)
    https://github.com/fedora-python/lxml_html_clean/security/
    advisories/GHSA-4jhm-jv67-739f
  * CVE-2026-41066: This release fixes a possible external entity
    injection (XXE) vulnerability in ``iterparse()`` and
    the ``ETCompatXMLParser``. (bsc#1263254, CVE-2026-41066)
- Bundled python was updated with CVE fixes:
  * CVE-2026-3446: Preventing ignoring excess Base64 data
    after the first padded quad in non-strict (default) mode.
    (bsc#1261970, CVE-2026-3446, gh#python/cpython#145264).
  * CVE-2026-3479: pkgutil.get_data() has the same security model
    as open(). The documented limitations ensure compatibility with
    non-filesystem loaders; Python doesn't check that.
    (bsc#1259989, CVE-2026-3479, gh#python/cpython#146121).
- Bundled python module pyopenssl contains CVE fixes:
  * CVE-2026-27459: large cookie value can lead to a buffer overflow
    (bsc#1271428, CVE-2026-27459)
- Remove unused paramiko python module from the bundle.
- Cleanup commented packages in include-rpm and include-deb
- Modified:
  * include-deb
  * include-rpm</changelog>
  <changelog author="marek.czernek@suse.com" date="1785326400">- Fix unit tests that fail due to async Tornado usage
- Added:
  * stabilize-testsuite-773.patch</changelog>
  <changelog author="pablo.suarezhernandez@suse.com" date="1785412800">- Prevent broken Salt Bundle on Ubuntu due regression in "tar" package
  from Ubuntu repositories (bsc#1271613)</changelog>
  <changelog author="vzhestkov@suse.com" date="1786017600">- Bundled python was updated with CVE fixes:
  * CVE-2026-13346: Arbitrary file installation via malicious package
    indexes. Remove ensurepip with bundled .whl files. (bsc#1273094)
  * CVE-2026-0864: Normalize all line endings (CR, CRLF, and LF) in
    configparser (bsc#1269066, gh#python/cpython#143927)
  * CVE-2026-1502: reject CR/LF in HTTP tunnel request headers
    (bsc#1261969, gh#python/cpython#146211)
  * CVE-2026-3276: Fix O(n^2) canonical ordering in
    unicodedata.normalize() (bsc#1267581, gh#python/cpython#149079)
  * CVE-2026-4360: Pass filter_function to TarFile._extract_one()
    during .extract() (bsc#1269959, gh#python/cpython#151987)
  * CVE-2026-4786: fix webbrowser %action substitution bypass of
    dash-prefix check (bsc#1262319, gh#python/cpython#148169)
  * CVE-2026-6019: protect against HTML injection by
    Base64-encoding cookie values embedded in JS
    (bsc#1262654, gh#python/cpython#90309)
  * CVE-2026-6100: prevent dangling pointer, which can end in the
    use-after-free error (bsc#1262098, gh#python/cpython#148395)
  * CVE-2026-7210: Use XML_SetHashSalt16Bytes in
    pyexpat/_elementtree when possible
    (bsc#1264962, gh#python/cpython#149018).
  * CVE-2026-7774: tarfile.data_filter: validate written link
    target (bsc#1267821, gh#149486)
  * CVE-2026-8328: Make ftplib not trust the PASV response
    (bsc#1265268)
  * CVE-2026-11940: fix the symlink escape via tarfile
    hardlink-extraction fallback (bsc#1268977)
  * CVE-2026-11972: Make tarfile._Stream.seek break at EOF
    (bsc#1269788, gh#python/cpython#151981)
  * CVE-2026-15308: Fix quadratic complexity in incremental parsing
    in HTMLParser (bsc#1271192, gh#python/cpython#153030)
- Bundled python module pip was updated to 25.0.1 with CVE fixes:
  * CVE-2026-13346: Arbitrary file installation via malicious package
    indexes (bsc#1273094)
  * CVE-2026-8643: Path traversal via malicious entry point name in pip
    wheel installation allows arbitrary file overwrite(bsc#1266669)
  * CVE-2026-6357: pip self-update functionality can import newly
    installed modules after wheel installation (bsc#1263442)
  * CVE-2026-3219: pip doesn't reject concatenated ZIP (bsc#1262429)
  * CVE-2026-1703: files may be extracted outside the installation
    directory when installing and extracting maliciously crafted
    wheel archives (bsc#1257599, gh#pypa/pip#13777)</changelog>
  <changelog author="marek.czernek@suse.com" date="1786449600">- Fix test failures with pytest&gt;=8
- Added:
  * migrate-rest_tornado-saltnado-tests-to-pytest-774.patch</changelog>
  <changelog author="marek.czernek@suse.com" date="1787918400">- Stop packaging tomli and exceptiongroup in the testsuite, as
  pytest&gt;=8 no longer requires them
- Modified:
  * include-deb
  * include-rpm</changelog>
</package>
</otherdata>