<?xml version="1.0" encoding="UTF-8"?>
<otherdata xmlns="http://linux.duke.edu/metadata/other" packages="3">
<package pkgid="3215f13abda5d83ab36382f75554f17713cd17a54ca4c55ffe52759ed28116d2" name="venv-salt-minion" arch="aarch64">
  <version epoch="0" ver="3006.0" rel="28.1"/>
  <changelog author="Alexander Graul &lt;alexander.graul@suse.com&gt;" date="1763985600">- CVE-2025-62349: Add minimum_auth_version to enforce security (bsc#1254257)
- Backport security fixes for vendored tornado
  * BDSA-2024-3438
  * BDSA-2024-3439
  * BDSA-2024-9026
- CVE-2025-62348: Junos module yaml loader fix (bsc#1254256)
- Added:
  * backport-3006.17-security-fixes-739.patch</changelog>
  <changelog author="Marek Czernek &lt;marek.czernek@suse.com&gt;" date="1767873600">- Extend warn_until period to 2027
- Added:
  * extend-fails-to-warnings-until-2027-742.patch</changelog>
  <changelog author="Marek Czernek &lt;marek.czernek@suse.com&gt;" date="1768392000">- Use internal deb classes instead of external aptsource lib
  * Drop dependency on saltbundlepy-apt
- Speed up wheel key.finger call (bsc#1240532)
- Backport security patches for Salt vendored tornado:
  * CVE-2025-67724: missing validation of supplied reason phrase (bsc#1254903)
  * CVE-2025-67725: fix DoS via malicious HTTP request (bsc#1254905)
  * CVE-2025-67726: fix HTTP header parameter parsing algorithm (bsc#1254904)
- CVE-2025-13836: limit http.client response read in NXOS modules
- Simplify and speed up utils.find_json function (bsc#1246130)
- Added:
  * use-internal-salt.utils.pkg.deb-classes-instead-of-a.patch
  * speedup-wheel-key.finger-call-bsc-1240532-713.patch
  * fixes-for-security-issues-cve-2025-13836-cve-2025-67.patch
  * simplify-utils.json.find_json-function.patch
- Modified:
  * include-deb</changelog>
  <changelog author="Marek Czernek &lt;marek.czernek@suse.com&gt;" date="1768824000">- Make syntax in httputil_test compatible with Python 3.6
- Fix KeyError in postgres module with PostgreSQL 17 (bsc#1254325)
- Added:
  * fix-tornado-s-httputil_test-syntax-for-python-3.6.patch
  * backport-add-maintain-m-privilege-to-postgres-module.patch</changelog>
  <changelog author="Michael Calmer &lt;mc@suse.com&gt;" date="1770033600">- Rebuild because of maintenance release</changelog>
  <changelog author="Victor Zhestkov &lt;vzhestkov@suse.com&gt;" date="1771243200">- Fix the typo causing buiding EL9 bundle without binary dependencies</changelog>
  <changelog author="Victor Zhestkov &lt;vzhestkov@suse.com&gt;" date="1772625600">- Fix the issue preventing SELinux profile to be loaded on SLES 16
  deployed using cloud images (bsc#1258957)</changelog>
  <changelog author="Victor Zhestkov &lt;vzhestkov@suse.com&gt;" date="1773403200">- Add x86_64_v2 as a possible rpm package architecture
- Make users with backslash working for salt-ssh (bsc#1254629)
- Fix ansible.playbooks extra-vars quoting (bsc#1257831)
- Fix virtualenv call in test helper to use proper python version
- Added:
  * add-x86_64_v2-as-a-possible-rpm-package-architecture.patch
  * make-users-with-backslash-working-for-salt-ssh-bsc-1.patch
  * fix-ansible.playbooks-extra-vars-quoting-bsc-1257831.patch
  * fix-virtualenv-call-in-test-helper-to-use-proper-pyt.patch</changelog>
  <changelog author="Victor Zhestkov &lt;vzhestkov@suse.com&gt;" date="1773748800">- Backport security patch for Salt vendored tornado (bsc#1259554):
  * CVE-2026-31958: Add limits on multipart form data parsing
- Added:
  * backport-of-the-cve-2026-31958-fix-bsc-1259554.patch</changelog>
  <changelog author="Marek Czernek &lt;marek.czernek@suse.com&gt;" date="1776168000">- Fix testsuite failures
- Added:
  * fix-test-failures-754.patch</changelog>
  <changelog author="Marek Czernek &lt;marek.czernek@suse.com&gt;" date="1777291200">- BDSA-2025-60810: Harden Tornado from invalid HTTP reason phrases
- Read full URI from ldap pillar config (bsc#1254900)
- Added:
  * bdsa-2025-60810-harden-against-invalid-http-reason-p.patch
  * read-full-uri-from-ldap-pillar-config-753.patch</changelog>
  <changelog author="Pablo Su&#xE1;rez Hern&#xE1;ndez &lt;pablo.suarezhernandez@suse.com&gt;" date="1778155200">- Specify .SO ver explicitly in BuildRequire for libsodium</changelog>
  <changelog author="Victor Zhestkov &lt;vzhestkov@suse.com&gt;" date="1778760000">- Use non vendored tornado with Python 3.11 (bsc#1257583, bsc#1259700)
- Added:
  * use-non-vendored-tornado-with-python-3.11.patch</changelog>
  <changelog author="Pablo Su&#xE1;rez Hern&#xE1;ndez &lt;pablo.suarezhernandez@suse.com&gt;" date="1779451200">- Add 'show_changes' arg to 'file.append/file.prepend" states
- Added:
  * add-show_changes-to-file.append-and-file.prepend-sta.patch</changelog>
  <changelog author="Yeray Guti&#xE9;rrez Cedr&#xE9;s &lt;yeray.gutierrez@suse.com&gt;" date="1780488000">- Calculate UUID grain for Xen PV guests (bsc#1255418)
- Added:
  * calculate-uuid-grain-for-xen-pv-guests-759.patch</changelog>
  <changelog author="Pablo Su&#xE1;rez Hern&#xE1;ndez &lt;pablo.suarezhernandez@suse.com&gt;" date="1780920000">- Fix deprecation warnings when running on Python 3.13
- Added:
  * fix-deprecation-warnings-when-running-on-python-3.13.patch</changelog>
  <changelog author="Pablo Su&#xE1;rez Hern&#xE1;ndez &lt;pablo.suarezhernandez@suse.com&gt;" date="1781092800">- Fix ImportError during reentrant SIGTERM shutdown
- Fix broken "pkg.info_installed" after migration to salt.utils.timeutil
- Added:
  * fix-importerror-during-reentrant-sigterm-shutdown.patch
  * fix-broken-pkg.info_installed-after-moving-to-salt.u.patch</changelog>
  <changelog author="Victor Zhestkov &lt;vzhestkov@suse.com&gt;" date="1782216000">- Fix the tests failing after switching to non-vendored tornado
- Fix the default group in tests for new users in SLE 15.6
- Use AsyncHTTPClient in salt.utils.http (bsc#1268325)
- Fix file fetching with cp module on non-vendored tornado
- Decode binary pillars for salt-ssh to avoid exceptions (bsc#1263822)
- Added:
  * fix-the-tests-failing-after-switching-to-non-vendore.patch
  * fix-the-default-group-in-tests-for-new-users-in-sle-.patch
  * use-asynchttpclient-in-salt.utils.http-bsc-1268325.patch
  * fix-file-fetching-with-non-vendored-tornado.patch
  * decode-binary-pillars-for-salt-ssh-to-avoid-exceptio.patch</changelog>
  <changelog author="Victor Zhestkov &lt;vzhestkov@suse.com&gt;" date="1782820800">- Bundled python module OpenSSL was updated with CVE fix:
  * CVE-2026-40475: improper input handling of null bytes
    can lead to silent data truncation and security-state
    inconsistency (bsc#1262803)</changelog>
  <changelog author="Victor Zhestkov &lt;vzhestkov@suse.com&gt;" date="1783080000">- Bundled python module tornado was updated with CVE fixes:
  * CVE-2026-49853: authorization header forwarded across
    cross-origin redirects in SimpleAsyncHTTPClient (bsc#1268395)
  * CVE-2026-49854: out-of-bounds memory access via C extension
    (bsc#1268396)
  * CVE-2026-49855: AsyncHTTPClient accumulates decompressed chunks
    without size limit (gzip bomb) (bsc#1268397)</changelog>
</package>
<package pkgid="cb8aadcf7c2efff4565077fbc7f303327b78cec9fb577bc7328da4c10f5de2df" name="venv-salt-minion" arch="src">
  <version epoch="0" ver="3006.0" rel="28.1"/>
  <changelog author="Alexander Graul &lt;alexander.graul@suse.com&gt;" date="1763985600">- CVE-2025-62349: Add minimum_auth_version to enforce security (bsc#1254257)
- Backport security fixes for vendored tornado
  * BDSA-2024-3438
  * BDSA-2024-3439
  * BDSA-2024-9026
- CVE-2025-62348: Junos module yaml loader fix (bsc#1254256)
- Added:
  * backport-3006.17-security-fixes-739.patch</changelog>
  <changelog author="Marek Czernek &lt;marek.czernek@suse.com&gt;" date="1767873600">- Extend warn_until period to 2027
- Added:
  * extend-fails-to-warnings-until-2027-742.patch</changelog>
  <changelog author="Marek Czernek &lt;marek.czernek@suse.com&gt;" date="1768392000">- Use internal deb classes instead of external aptsource lib
  * Drop dependency on saltbundlepy-apt
- Speed up wheel key.finger call (bsc#1240532)
- Backport security patches for Salt vendored tornado:
  * CVE-2025-67724: missing validation of supplied reason phrase (bsc#1254903)
  * CVE-2025-67725: fix DoS via malicious HTTP request (bsc#1254905)
  * CVE-2025-67726: fix HTTP header parameter parsing algorithm (bsc#1254904)
- CVE-2025-13836: limit http.client response read in NXOS modules
- Simplify and speed up utils.find_json function (bsc#1246130)
- Added:
  * use-internal-salt.utils.pkg.deb-classes-instead-of-a.patch
  * speedup-wheel-key.finger-call-bsc-1240532-713.patch
  * fixes-for-security-issues-cve-2025-13836-cve-2025-67.patch
  * simplify-utils.json.find_json-function.patch
- Modified:
  * include-deb</changelog>
  <changelog author="Marek Czernek &lt;marek.czernek@suse.com&gt;" date="1768824000">- Make syntax in httputil_test compatible with Python 3.6
- Fix KeyError in postgres module with PostgreSQL 17 (bsc#1254325)
- Added:
  * fix-tornado-s-httputil_test-syntax-for-python-3.6.patch
  * backport-add-maintain-m-privilege-to-postgres-module.patch</changelog>
  <changelog author="Michael Calmer &lt;mc@suse.com&gt;" date="1770033600">- Rebuild because of maintenance release</changelog>
  <changelog author="Victor Zhestkov &lt;vzhestkov@suse.com&gt;" date="1771243200">- Fix the typo causing buiding EL9 bundle without binary dependencies</changelog>
  <changelog author="Victor Zhestkov &lt;vzhestkov@suse.com&gt;" date="1772625600">- Fix the issue preventing SELinux profile to be loaded on SLES 16
  deployed using cloud images (bsc#1258957)</changelog>
  <changelog author="Victor Zhestkov &lt;vzhestkov@suse.com&gt;" date="1773403200">- Add x86_64_v2 as a possible rpm package architecture
- Make users with backslash working for salt-ssh (bsc#1254629)
- Fix ansible.playbooks extra-vars quoting (bsc#1257831)
- Fix virtualenv call in test helper to use proper python version
- Added:
  * add-x86_64_v2-as-a-possible-rpm-package-architecture.patch
  * make-users-with-backslash-working-for-salt-ssh-bsc-1.patch
  * fix-ansible.playbooks-extra-vars-quoting-bsc-1257831.patch
  * fix-virtualenv-call-in-test-helper-to-use-proper-pyt.patch</changelog>
  <changelog author="Victor Zhestkov &lt;vzhestkov@suse.com&gt;" date="1773748800">- Backport security patch for Salt vendored tornado (bsc#1259554):
  * CVE-2026-31958: Add limits on multipart form data parsing
- Added:
  * backport-of-the-cve-2026-31958-fix-bsc-1259554.patch</changelog>
  <changelog author="Marek Czernek &lt;marek.czernek@suse.com&gt;" date="1776168000">- Fix testsuite failures
- Added:
  * fix-test-failures-754.patch</changelog>
  <changelog author="Marek Czernek &lt;marek.czernek@suse.com&gt;" date="1777291200">- BDSA-2025-60810: Harden Tornado from invalid HTTP reason phrases
- Read full URI from ldap pillar config (bsc#1254900)
- Added:
  * bdsa-2025-60810-harden-against-invalid-http-reason-p.patch
  * read-full-uri-from-ldap-pillar-config-753.patch</changelog>
  <changelog author="Pablo Su&#xE1;rez Hern&#xE1;ndez &lt;pablo.suarezhernandez@suse.com&gt;" date="1778155200">- Specify .SO ver explicitly in BuildRequire for libsodium</changelog>
  <changelog author="Victor Zhestkov &lt;vzhestkov@suse.com&gt;" date="1778760000">- Use non vendored tornado with Python 3.11 (bsc#1257583, bsc#1259700)
- Added:
  * use-non-vendored-tornado-with-python-3.11.patch</changelog>
  <changelog author="Pablo Su&#xE1;rez Hern&#xE1;ndez &lt;pablo.suarezhernandez@suse.com&gt;" date="1779451200">- Add 'show_changes' arg to 'file.append/file.prepend" states
- Added:
  * add-show_changes-to-file.append-and-file.prepend-sta.patch</changelog>
  <changelog author="Yeray Guti&#xE9;rrez Cedr&#xE9;s &lt;yeray.gutierrez@suse.com&gt;" date="1780488000">- Calculate UUID grain for Xen PV guests (bsc#1255418)
- Added:
  * calculate-uuid-grain-for-xen-pv-guests-759.patch</changelog>
  <changelog author="Pablo Su&#xE1;rez Hern&#xE1;ndez &lt;pablo.suarezhernandez@suse.com&gt;" date="1780920000">- Fix deprecation warnings when running on Python 3.13
- Added:
  * fix-deprecation-warnings-when-running-on-python-3.13.patch</changelog>
  <changelog author="Pablo Su&#xE1;rez Hern&#xE1;ndez &lt;pablo.suarezhernandez@suse.com&gt;" date="1781092800">- Fix ImportError during reentrant SIGTERM shutdown
- Fix broken "pkg.info_installed" after migration to salt.utils.timeutil
- Added:
  * fix-importerror-during-reentrant-sigterm-shutdown.patch
  * fix-broken-pkg.info_installed-after-moving-to-salt.u.patch</changelog>
  <changelog author="Victor Zhestkov &lt;vzhestkov@suse.com&gt;" date="1782216000">- Fix the tests failing after switching to non-vendored tornado
- Fix the default group in tests for new users in SLE 15.6
- Use AsyncHTTPClient in salt.utils.http (bsc#1268325)
- Fix file fetching with cp module on non-vendored tornado
- Decode binary pillars for salt-ssh to avoid exceptions (bsc#1263822)
- Added:
  * fix-the-tests-failing-after-switching-to-non-vendore.patch
  * fix-the-default-group-in-tests-for-new-users-in-sle-.patch
  * use-asynchttpclient-in-salt.utils.http-bsc-1268325.patch
  * fix-file-fetching-with-non-vendored-tornado.patch
  * decode-binary-pillars-for-salt-ssh-to-avoid-exceptio.patch</changelog>
  <changelog author="Victor Zhestkov &lt;vzhestkov@suse.com&gt;" date="1782820800">- Bundled python module OpenSSL was updated with CVE fix:
  * CVE-2026-40475: improper input handling of null bytes
    can lead to silent data truncation and security-state
    inconsistency (bsc#1262803)</changelog>
  <changelog author="Victor Zhestkov &lt;vzhestkov@suse.com&gt;" date="1783080000">- Bundled python module tornado was updated with CVE fixes:
  * CVE-2026-49853: authorization header forwarded across
    cross-origin redirects in SimpleAsyncHTTPClient (bsc#1268395)
  * CVE-2026-49854: out-of-bounds memory access via C extension
    (bsc#1268396)
  * CVE-2026-49855: AsyncHTTPClient accumulates decompressed chunks
    without size limit (gzip bomb) (bsc#1268397)</changelog>
</package>
<package pkgid="25a3af29ccea74c683d447804df28b2cf9e25449433a3db9eb8deebd7c7fd0e1" name="venv-salt-minion" arch="x86_64">
  <version epoch="0" ver="3006.0" rel="28.1"/>
  <changelog author="Alexander Graul &lt;alexander.graul@suse.com&gt;" date="1763985600">- CVE-2025-62349: Add minimum_auth_version to enforce security (bsc#1254257)
- Backport security fixes for vendored tornado
  * BDSA-2024-3438
  * BDSA-2024-3439
  * BDSA-2024-9026
- CVE-2025-62348: Junos module yaml loader fix (bsc#1254256)
- Added:
  * backport-3006.17-security-fixes-739.patch</changelog>
  <changelog author="Marek Czernek &lt;marek.czernek@suse.com&gt;" date="1767873600">- Extend warn_until period to 2027
- Added:
  * extend-fails-to-warnings-until-2027-742.patch</changelog>
  <changelog author="Marek Czernek &lt;marek.czernek@suse.com&gt;" date="1768392000">- Use internal deb classes instead of external aptsource lib
  * Drop dependency on saltbundlepy-apt
- Speed up wheel key.finger call (bsc#1240532)
- Backport security patches for Salt vendored tornado:
  * CVE-2025-67724: missing validation of supplied reason phrase (bsc#1254903)
  * CVE-2025-67725: fix DoS via malicious HTTP request (bsc#1254905)
  * CVE-2025-67726: fix HTTP header parameter parsing algorithm (bsc#1254904)
- CVE-2025-13836: limit http.client response read in NXOS modules
- Simplify and speed up utils.find_json function (bsc#1246130)
- Added:
  * use-internal-salt.utils.pkg.deb-classes-instead-of-a.patch
  * speedup-wheel-key.finger-call-bsc-1240532-713.patch
  * fixes-for-security-issues-cve-2025-13836-cve-2025-67.patch
  * simplify-utils.json.find_json-function.patch
- Modified:
  * include-deb</changelog>
  <changelog author="Marek Czernek &lt;marek.czernek@suse.com&gt;" date="1768824000">- Make syntax in httputil_test compatible with Python 3.6
- Fix KeyError in postgres module with PostgreSQL 17 (bsc#1254325)
- Added:
  * fix-tornado-s-httputil_test-syntax-for-python-3.6.patch
  * backport-add-maintain-m-privilege-to-postgres-module.patch</changelog>
  <changelog author="Michael Calmer &lt;mc@suse.com&gt;" date="1770033600">- Rebuild because of maintenance release</changelog>
  <changelog author="Victor Zhestkov &lt;vzhestkov@suse.com&gt;" date="1771243200">- Fix the typo causing buiding EL9 bundle without binary dependencies</changelog>
  <changelog author="Victor Zhestkov &lt;vzhestkov@suse.com&gt;" date="1772625600">- Fix the issue preventing SELinux profile to be loaded on SLES 16
  deployed using cloud images (bsc#1258957)</changelog>
  <changelog author="Victor Zhestkov &lt;vzhestkov@suse.com&gt;" date="1773403200">- Add x86_64_v2 as a possible rpm package architecture
- Make users with backslash working for salt-ssh (bsc#1254629)
- Fix ansible.playbooks extra-vars quoting (bsc#1257831)
- Fix virtualenv call in test helper to use proper python version
- Added:
  * add-x86_64_v2-as-a-possible-rpm-package-architecture.patch
  * make-users-with-backslash-working-for-salt-ssh-bsc-1.patch
  * fix-ansible.playbooks-extra-vars-quoting-bsc-1257831.patch
  * fix-virtualenv-call-in-test-helper-to-use-proper-pyt.patch</changelog>
  <changelog author="Victor Zhestkov &lt;vzhestkov@suse.com&gt;" date="1773748800">- Backport security patch for Salt vendored tornado (bsc#1259554):
  * CVE-2026-31958: Add limits on multipart form data parsing
- Added:
  * backport-of-the-cve-2026-31958-fix-bsc-1259554.patch</changelog>
  <changelog author="Marek Czernek &lt;marek.czernek@suse.com&gt;" date="1776168000">- Fix testsuite failures
- Added:
  * fix-test-failures-754.patch</changelog>
  <changelog author="Marek Czernek &lt;marek.czernek@suse.com&gt;" date="1777291200">- BDSA-2025-60810: Harden Tornado from invalid HTTP reason phrases
- Read full URI from ldap pillar config (bsc#1254900)
- Added:
  * bdsa-2025-60810-harden-against-invalid-http-reason-p.patch
  * read-full-uri-from-ldap-pillar-config-753.patch</changelog>
  <changelog author="Pablo Su&#xE1;rez Hern&#xE1;ndez &lt;pablo.suarezhernandez@suse.com&gt;" date="1778155200">- Specify .SO ver explicitly in BuildRequire for libsodium</changelog>
  <changelog author="Victor Zhestkov &lt;vzhestkov@suse.com&gt;" date="1778760000">- Use non vendored tornado with Python 3.11 (bsc#1257583, bsc#1259700)
- Added:
  * use-non-vendored-tornado-with-python-3.11.patch</changelog>
  <changelog author="Pablo Su&#xE1;rez Hern&#xE1;ndez &lt;pablo.suarezhernandez@suse.com&gt;" date="1779451200">- Add 'show_changes' arg to 'file.append/file.prepend" states
- Added:
  * add-show_changes-to-file.append-and-file.prepend-sta.patch</changelog>
  <changelog author="Yeray Guti&#xE9;rrez Cedr&#xE9;s &lt;yeray.gutierrez@suse.com&gt;" date="1780488000">- Calculate UUID grain for Xen PV guests (bsc#1255418)
- Added:
  * calculate-uuid-grain-for-xen-pv-guests-759.patch</changelog>
  <changelog author="Pablo Su&#xE1;rez Hern&#xE1;ndez &lt;pablo.suarezhernandez@suse.com&gt;" date="1780920000">- Fix deprecation warnings when running on Python 3.13
- Added:
  * fix-deprecation-warnings-when-running-on-python-3.13.patch</changelog>
  <changelog author="Pablo Su&#xE1;rez Hern&#xE1;ndez &lt;pablo.suarezhernandez@suse.com&gt;" date="1781092800">- Fix ImportError during reentrant SIGTERM shutdown
- Fix broken "pkg.info_installed" after migration to salt.utils.timeutil
- Added:
  * fix-importerror-during-reentrant-sigterm-shutdown.patch
  * fix-broken-pkg.info_installed-after-moving-to-salt.u.patch</changelog>
  <changelog author="Victor Zhestkov &lt;vzhestkov@suse.com&gt;" date="1782216000">- Fix the tests failing after switching to non-vendored tornado
- Fix the default group in tests for new users in SLE 15.6
- Use AsyncHTTPClient in salt.utils.http (bsc#1268325)
- Fix file fetching with cp module on non-vendored tornado
- Decode binary pillars for salt-ssh to avoid exceptions (bsc#1263822)
- Added:
  * fix-the-tests-failing-after-switching-to-non-vendore.patch
  * fix-the-default-group-in-tests-for-new-users-in-sle-.patch
  * use-asynchttpclient-in-salt.utils.http-bsc-1268325.patch
  * fix-file-fetching-with-non-vendored-tornado.patch
  * decode-binary-pillars-for-salt-ssh-to-avoid-exceptio.patch</changelog>
  <changelog author="Victor Zhestkov &lt;vzhestkov@suse.com&gt;" date="1782820800">- Bundled python module OpenSSL was updated with CVE fix:
  * CVE-2026-40475: improper input handling of null bytes
    can lead to silent data truncation and security-state
    inconsistency (bsc#1262803)</changelog>
  <changelog author="Victor Zhestkov &lt;vzhestkov@suse.com&gt;" date="1783080000">- Bundled python module tornado was updated with CVE fixes:
  * CVE-2026-49853: authorization header forwarded across
    cross-origin redirects in SimpleAsyncHTTPClient (bsc#1268395)
  * CVE-2026-49854: out-of-bounds memory access via C extension
    (bsc#1268396)
  * CVE-2026-49855: AsyncHTTPClient accumulates decompressed chunks
    without size limit (gzip bomb) (bsc#1268397)</changelog>
</package>
</otherdata>