This update for cpio fixes the following issues: CVE-2023-7207: Fixed path traversal vulnerability (bsc#1218571, bsc#1219238)

This update for jetty-minimal fixes the following issues: CVE-2024-22201: Fixed denial-of-service via HTTP/2 connection leak (bsc#1220437).

This update for timezone fixes the following issues: Update to version 2024a Kazakhstan unifies on UTC+5 Palestine springs forward a week later than previously predicted in 2024 and 2025 Asia/HoChiMinh's 1955-07-01 transition occurred at 01:00 not 00:00 From 1947 through 1949, Toronto's transitions occurred at 02:00 not 00:00 In 1911 Miquelon adopted standard time on June 15, not May 15 The FROM and TO columns of Rule lines can no longer be "minimum" localtime no longer mishandle some timestamps strftime %s now uses tmgmtoff if available Ittoqqortoormiit, Greenland changes time zones on 2024-03-31 Vostok, Antarctica changed time zones on 2023-12-18 Casey, Antarctica changed time zones five times since 2020 Code and data fixes for Palestine timestamps starting in 2072 A new data file zonenow.tab for timestamps starting now Much of Greenland changed its standard time from -03 to -02 on 2023-03-25 localtime.c no longer mishandles TZif files that contain a single transition into a DST regime tzselect no longer creates temporary files tzselect no longer mishandles the following: Spaces and most other special characters in BUGEMAIL, PACKAGE, TZDIR, and VERSION. TZ strings when using mawk 1.4.3, which mishandles regular expressions of the form /X{2,}/ ISO 6709 coordinates when using an awk that lacks the GNU extension of newlines in -v option-arguments Non UTF-8 locales when using an iconv command that lacks the GNU //TRANSLIT extension zic no longer mishandles data for Palestine after the year 2075

This update for gstreamer-plugins-bad fixes the following issues: CVE-2023-44446: Fixed use-after-free remote code execution vulnerability via MXF file (bsc#1217213).

This update for postgresql-jdbc fixes the following issues: CVE-2024-1597: Fixed SQL Injection via line comment generation (bsc#1220644).

This update for nodejs16 fixes the following issues: Security issues fixed: CVE-2023-46809: Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding) (bsc#1219997). CVE-2024-22019: http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks (bsc#1219993). CVE-2024-22025: Denial of Service by resource exhaustion in fetch() brotli decoding (bsc#1220014). CVE-2024-24758: ignore proxy-authorization header (bsc#1220017). CVE-2024-24806: fix improper domain lookup that potentially leads to SSRF attacks (bsc#1219724).

This update for nodejs14 fixes the following issues: Security issues fixed: CVE-2023-46809: Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding) (bsc#1219997). CVE-2024-22019: http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks (bsc#1219993). CVE-2024-22025: Denial of Service by resource exhaustion in fetch() brotli decoding (bsc#1220014). CVE-2024-24806: fix improper domain lookup that potentially leads to SSRF attacks (bsc#1219724).

This update for nodejs12 fixes the following issues: Security issues fixed: CVE-2023-46809: Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding) (bsc#1219997). CVE-2024-22019: http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks (bsc#1219993). CVE-2024-22025: Denial of Service by resource exhaustion in fetch() brotli decoding (bsc#1220014). CVE-2024-24806: fix improper domain lookup that potentially leads to SSRF attacks (bsc#1219724).

This update for suse-build-key fixes the following issues: Switch container key to be default RSA 4096bit. (jsc#PED-2777) run import script also in %posttrans section, but only when libzypp is not active. bsc#1219189 bsc#1219123

This update for Java fixes the following issues: apache-commons-codec was updated to version 1.16.1: Changes in version 1.16.1:

New features:

Added Maven property project.build.outputTimestamp for build reproducibility

Bugs fixed:

Correct error in Base64 Javadoc Added minimum Java version in changes.xml Documentation update for the org.apache.commons.codec.digest. package Precompile regular expression in UnixCrypt.crypt(byte[], String) Fixed possible IndexOutOfBoundException in PhoneticEngine.encode method Fixed possible ArrayIndexOutOfBoundsException in QuotedPrintableCodec.encodeQuotedPrintable() method Fixed possible StringIndexOutOfBoundException in MatchRatingApproachEncoder.encode() method Fixed possible ArrayIndexOutOfBoundException in RefinedSoundex.getMappingCode() Fixed possible IndexOutOfBoundsException in PercentCodec.insertAlwaysEncodeChars() method Deprecated UnixCrypt 0-argument constructor Deprecated Md5Crypt 0-argument constructor Deprecated Crypt 0-argument constructor Deprecated StringUtils 0-argument constructor Deprecated Resources 0-argument constructor Deprecated Charsets 0-argument constructor Deprecated CharEncoding 0-argument constructor

Changes in version 1.16.0:

Remove duplicated words from Javadocs

Use Standard Charset object Use String.contains() functions Avoid use toString() or substring() in favor of a simplified expression Fixed byte-skipping in Base16 decoding Fixed several typos, improve writing in some javadocs BaseNCodecOutputStream.eof() should not throw IOException. Javadoc improvements and cleanups. Deprecated BaseNCodec.isWhiteSpace(byte) and use Character.isWhitespace(int). Added support for Blake3 family of hashes Added github/codeql-action Bump actions/cache from v2 to v3.0.10 Bump actions/setup-java from v1.4.1 to 3.5.1 Bump actions/checkout from 2.3.2 to 3.1.0 Bump commons-parent from 52 to 58 Bump junit from 4.13.1 to 5.9.1 Bump Java 7 to 8. Bump japicmp-maven-plugin from 0.14.3 to 0.17.1. Bump jacoco-maven-plugin from 0.8.5 to 0.8.8 (Fixes Java 15 builds). Bump maven-surefire-plugin from 2.22.2 to 3.0.0-M7 Bump maven-javadoc-plugin from 3.2.0 to 3.4.1. Bump animal-sniffer-maven-plugin from 1.19 to 1.22. Bump maven-pmd-plugin from 3.13.0 to 3.19.0 Bump pmd from 6.47.0 to 6.52.0. Bump maven-checkstyle-plugin from 2.17 to 3.2.0 Bump checkstyle from 8.45.1 to 9.3 Bump taglist-maven-plugin from 2.4 to 3.0.0 Bump jacoco-maven-plugin from 0.8.7 to 0.8.8. apache-commons-compress was updated to version 1.26: Changes in version 1.26:

Security issues fixed:

CVE-2024-26308: Fixed allocation of Resources Without Limits or Throttling vulnerability in Apache Commons Compress (bsc#1220068) CVE-2024-25710: Fixed loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Commons Compress (bsc#1220070)

New Features:

Added and use ZipFile.builder(), ZipFile.Builder, and deprecate constructors Added and use SevenZFile.builder(), SevenZFile.Builder, and deprecate constructors Added and use ArchiveInputStream.getCharset() Added and use ArchiveEntry.resolveIn(Path) Added Maven property project.build.outputTimestamp for build reproducibility

Bugs fixed:

Check for invalid PAX values in TarArchiveEntry Fixed zero size headers in ArjInputStream Fixes and tests for ArInputStream Fixes for dump file parsing Improved CPIO exception detection and handling Deprecated SkipShieldingInputStream without replacement (nolonger used) Reuse commons-codec, don't duplicate class PureJavaCrc32C (removed package-private class) Reuse commons-codec, don't duplicate class XXHash32 (deprecated class) Reuse commons-io, don't duplicate class Charsets (deprecated class) Reuse commons-io, don't duplicate class IOUtils (deprecated methods) Reuse commons-io, don't duplicate class BoundedInputStream (deprecated class) Reuse commons-io, don't duplicate class FileTimes (deprecated TimeUtils methods) Reuse Arrays.equals(byte[], byte[]) and deprecate ArchiveUtils.isEqual(byte[], byte[]) Added a null-check for the class loader of OsgiUtils Added a null-check in Pack200.newInstance(String, String) Deprecated ChecksumCalculatingInputStream in favor of java.util.zip.CheckedInputStream Deprecated CRC32VerifyingInputStream.CRC32VerifyingInputStream(InputStream, long, int) FramedSnappyCompressorOutputStream produces incorrect output when writing a large buffer Fixed TAR directory entries being misinterpreted as files Deprecated unused method FileNameUtils.getBaseName(String) Deprecated unused method FileNameUtils.getExtension(String) ArchiveInputStream.BoundedInputStream.read() incorrectly adds 1 for EOF to the bytes read count Deprecated IOUtils.read(File, byte[]) Deprecated IOUtils.copyRange(InputStream, long, OutputStream, int) ZipArchiveOutputStream multi archive updates metadata in incorrect file Deprecated ByteUtils.InputStreamByteSupplier Deprecated ByteUtils.fromLittleEndian(InputStream, int) Deprecated ByteUtils.toLittleEndian(DataOutput, long, int) Reduce duplication by having ArchiveInputStream extend FilterInputStream Support preamble garbage in ZipArchiveInputStream Fixed formatting the lowest expressable DOS time Dropped reflection from ExtraFieldUtils static initialization Preserve exception causation in ExtraFieldUtils.register(Class)

Changes in version 1.25:

For the full list of changes please consult: https://commons.apache.org/proper/commons-compress/changes-report.html#a1.25.0

Changes in version 1.24:

For the full list of changes please consult: https://commons.apache.org/proper/commons-compress/changes-report.html#a1.24.0

Changes in version 1.23:

For the full list of changes please consult: https://commons.apache.org/proper/commons-compress/changes-report.html#a1.23.0

Changes in version 1.22:

For the full list of changes please consult: https://commons.apache.org/proper/commons-compress/changes-report.html#a1.22 apache-commons-io was updated to version 2.15.1: Changes in version 2.15.1:

For the full list of changes please consult: https://commons.apache.org/proper/commons-io/changes-report.html#a2.15.1

Changes in version 2.15.0:

For the full list of changes please consult: https://commons.apache.org/proper/commons-io/changes-report.html#a2.15.0

Changes in version 2.14.0:

For the full list of changes please consult: https://commons.apache.org/proper/commons-io/changes-report.html#a2.14.0 javapackages-meta: Syncing the version with javapackages-tools 6.2.0 Remove unnecessary dependencies maven was updated to version 3.9.6: Changes in version 3.9.6:

Bugs fixed:

Error message when modelVersion is 4.0 is confusing

Improvements:

Colorize transfer messages Support ${project.basedir} in file profile activation Allow to exclude plugins from validation

Tasks:

Maven Resolver Provider classes ctor change Undeprecate wrongly deprecated repository metadata Deprecated org.apache.maven.repository.internal.MavenResolverModule maven-resolver-provider: introduce NAME constants.

Dependency upgrade:

Updated to Resolver 1.9.16 Upgraded Sisu version to 0.9.0.M2 Upgraded Resolver version to 1.9.18 Upgraded to parent POM 41 Upgraded default plugin bindings maven-assembly-plugin: Explicitely require commons-io:commons-io and commons-codec:common-codes artifacts that are optional in apache-commons-compress maven-doxia was updated to version 1.12.0: Changes in version 1.12.0:

Upgraded to FOP 2.2 Fixed rendering links and paragraphs inside tables Rewrite .md and .markdown links to .html Upgraded HttpComponents: httpclient to 4.5.8 and httpcore to 4.4.11 Escape links to xml based figureGraphics image elements SECURITY: Use HTTPS to resolve dependencies in Maven Build Removed old Maven 1 and 2 info Updated commons-lang to 3.8.1 Dropped dependency to outdated Log4j Fixed Java 7 compatibility that was broken Import tests from maven-site-plugin Fixed crosslinks starting with a dot in markdown files Replace deprecated class from commons-lang Fill in some generic types maven-doxia-sitetools was updated to version 1.11.1: Changes in version 1.11.1:

Bugs fixed:

CLIRR can't find previous version

Improvements:

Removed all   in default-site-macros.vm and replace by a space Improved documentation on site.xml inheritance vs interpolation

Tasks:

Deprecated Doxia Sitetools Doc Renderer

Dependency upgrade:

Fixed javadoc issues with JDK 8 when generating documentation Wrong coordinates for jaicore: hyphen should be underscore Use latest JUnit version 4.13.2 Upgraded Plexus Utils to 3.3.0 Upgraded Plexus Interpolation to 1.26 Upgraded Maven Doxia to 1.10 Upgraded Maven Doxia to 1.11.1 maven-jar-plugin was updated to version 3.3.0: Changes in version 3.3.0:

Bugs fixed:

outputTimestamp not applied to module-info; breaks reproducible builds

Task:

Updated plugin (requires Maven 3.2.5+) Java 8 as minimum

Dependency upgrade:

Upgraded Plexus Utils to 3.3.1 Removed override for Plexus Archiver to fix order of META-INF/ and META-INF/MANIFEST.MF entries Upgraded Parent to 36 Updated Plexus Utils to 3.4.2 Upgraded Parent to 37 maven-jar-plugin was updated to version 3.6.0: Changes from version 3.6.0:

Bugs fixed:

Setting maven.javadoc.isoffline seems to have no effect javadoc site is broken for projects that contain modules Alternative doclet page points to an SEO spammy page [REGRESSION] Transitive dependencies of docletArtifact missing Unresolvable link in javadoc tag with value ResourcesBundleMojo#getAttachmentClassifier() found in ResourcesBundleMojo IOException --> NullPointerException in JavadocUtil.copyResource JavadocReportTest.testExceptions is broken javadoc creates invalid --patch-module statements javadoc plugin can not deal with transitive filename based modules

Improvements:

Clean up deprecated and unpreferred methods in JavadocUtil Cleanup dependency declarations as best possible Allow building javadoc "the old fashioned way" after Java 8

Tasks:

Dropped use of deprecated localRepository mojo parameter Make build pass with Java 20 Refresh download page

Dependency upgrade:

Updated to commons-io 2.13.0 Updated plexus-archiver from 4.7.1 to 4.8.0 Upgraded Parent to 40

Changes from version 3.5.0:

Bugs fixed:

Invalid anchors in Javadoc and plugin mojo Plugin duplicates classes in Java 8 all-classes lists javadoc site creation ignores configuration parameters

Improvements:

Deprecated parameter "stylesheet" Parse stderr output and suppress informational lines Link to Javadoc references from JDK 17 Migrate components to JSR 330, get rid of maven-artifact-transfer, update to parent 37

Tasks:

Removed remains of org.codehaus.doxia.sink.Sink

Dependency upgrades:

Upgraded plugins in ITs Upgraded to Maven 3.2.5 Updated Maven Archiver to 3.6.0 Upgraded Maven Reporting API to 3.1.1/Complete with Maven Reporting Impl 3.2.0 Upgraded commons-text to 1.10.0 Upgraded Parent to 39 Upgraded plugins and components maven-reporting-api was updated to version 3.1.1: Restore binary compat for MavenReport maven-reporting-impl was updated to version 3.2.0: Changes in version 3.2.0:

Improvement:

Render with a skin when report is run in standalone mode

Dependency upgrades:

Upgraded Maven Reporting API to 3.1.1 Upgraded plugins and components in project and ITs maven-resolver was updated to version 1.9.18: Changes in version 1.9.18:

Bugs fixed:

Sporadic AccessDeniedEx on Windows Undo FileUtils changes that altered non-Windows execution path

Improvements:

Native transport should retry on HTTP 429 (Retry-After)

Task:

Deprecated Guice modules Get rid of component name string literals, make them constants and reusable Expose configuration for inhibiting Expect-Continue handshake in 1.x Refresh download page Resolver should not override given HTTP transport default use of expect-continue handshake maven-resources-plugin was updated to version 3.3.1: Changes in version 3.3.1:

Bugs fixed:

Resource plugin's handling of symbolic links changed in 3.0.x, broke existing behavior Resource copying not using specified encoding java.nio.charset.MalformedInputException: Input length = 1 Filtering of Maven properties with long names is not working after transition from 2.6 to 3.2.0 Valid location for directory parameter is always required Symlinks cause copying resources to fail FileUtils.copyFile() fails with source file having lastModified = 0

New Features:

Added ability to flatten folder structure into target directory when copying resources

Improvements:

Make tests jar reproducible Describe from and to in "Copying xresources" info message

Task:

Dropped plexus legacy Updated to parent POM 39, reformat sources Updated plugin (requires Maven 3.2.5+) Require Java 8

Dependency upgrade:

Upgraded maven-plugin parent to 36 Upgraded Maven Filtering to 3.3.0 Upgraded plexus-utils to 3.5.1 Upgraded to maven-filtering 3.3.1 sbt: Fixed RPM package build with maven 3.9.6 and maven-resolver 1.9.18 xmvn: Modify the xmvn-install script to work with new apache-commons-compress Recompiling RPM package to resolve package building issues with maven-lib

This update for glib2 fixes the following issues: CVE-2021-28153: Fixed an issue where symlink targets would be incorrectly created as empty files (bsc#1183533).

This update for postgresql fixes the following issues: Require fillup package to properly create the config file (bsc#1219340)

This update for bind fixes the following issues: CVE-2023-2828: Fixed denial-of-service against recursive resolvers related to cache-cleaning algorithm (bsc#1212544).

This update for MozillaFirefox fixes the following issues: Update to Firefox Extended Support Release 115.8.0 ESR (MFSA 2024-06) (bsc#1220048): CVE-2024-1546: Out-of-bounds memory read in networking channels CVE-2024-1547: Alert dialog could have been spoofed on another site CVE-2024-1548: Fullscreen Notification could have been hidden by select element CVE-2024-1549: Custom cursor could obscure the permission dialog CVE-2024-1550: Mouse cursor re-positioned unexpectedly could have led to unintended permission grants CVE-2024-1551: Multipart HTTP Responses would accept the Set-Cookie header in response parts CVE-2024-1552: Incorrect code generation on 32-bit ARM devices

CVE-2024-1553: Memory safety bugs fixed in Firefox 123, Firefox ESR 115.8, and Thunderbird 115.8

Recommend libfido2-udev on codestreams that exist, in order to try to get security keys (e.g. Yubikeys) work out of the box. (bsc#1184272)

This update for docker fixes the following issues: Vendor latest buildkit v0.11 including bugfixes for the following: CVE-2024-23653: BuildKit API doesn't validate entitlement on container creation (bsc#1219438). CVE-2024-23652: Fixed arbitrary deletion of files (bsc#1219268). CVE-2024-23651: Fixed race condition in mount (bsc#1219267).

This update for Java fixes the following issues: plexus-archiver was updated from version 4.2.1 to 4.8.0: Changes of 4.8.0:

Security issues fixed:

CVE-2023-37460: Avoid override target symlink by standard file in AbstractUnArchiver (bsc#1215973)

New features and improvements:

Added tzst alias for tar.zst archiver/unarchived

Bugs fixed:

Detect permissions for addFile

Maintenance:

Removed public modifier from JUnit 5 tests Use https in scm/url Removed junit-jupiter-engine from project dependencies Removed parent and reports menu from site Cleanup after "veryLargeJar" test Override project.url

Changes of 4.7.1:

Bugs fixed:

Don't apply umask on unknown perms (Win)

Changes of 4.7.0:

New features and improvements:

add umask support and use 022 in RB mode Use NIO Files for creating temporary files Deprecate the JAR Index feature (JDK-8302819) Added Archiver aliases for tar.

Maintenance:

Use JUnit TempDir to manage temporary files in tests Override uId and gId for Tar in test Bump maven-resources-plugin from 2.7 to 3.3.1

Changes of 4.6.3:

New features and improvements:

Fixed path traversal vulnerability The vulnerability affects only directories whose name begins with the same prefix as the destination directory. For example malicious archive may extract file in /opt/directory instead of /opt/dir.

Changes of 4.6.2:

Bugs fixed:

Fixed regression in handling symbolic links

Changes of 4.6.1:

Bugs fixed:

Normalize file separators before warning about equal archive entries

Changes of 4.6.0:

New features and improvements:

keep file/directory permissions in Reproducible Builds mode

Changes of 4.5.0:

New features and improvements:

Added zstd (un)archiver support

Bugs fixed:

Fixed UnArchiver#isOverwrite not working as expected

Changes of 4.4.0:

New features and improvements:

Drop legacy plexus API and use only JSR330 components

Changes of 4.3.0:

New features and improvements:

Require Java 8 Refactor to use FileTime API Rename setTime method to setZipEntryTime Convert InputStreamSupplier to lambdas

Bugs fixed:

Reproducible Builds not working when using modular jar

Changes of 4.2.7:

New features and improvements:

Respect order of META-INF/ and META-INF/MANIFEST.MF entries in a JAR file

Changes of 4.2.6:

New features and improvements:

FileInputStream, FileOutputStream, FileReader and FileWriter are no longer used Code cleanup

Changes of 4.2.5:

New features and improvements:

Speed improvements

Bugs fixed:

Fixed use of a mismatching Unicode path extra field in zip unarchiving

Changes of 4.2.4:

Bugs fixed:

Fixed unjustified warning about casing for directory entries

Changes of 4.2.2:

Bugs fixed:

DirectoryArchiver fails for symlinks if a parent directory doesn't exist objectweb-asm was updated to version 9.6: Changes of version 9.6:

New Opcodes.V22 constant for Java 22

Bugs fixed:

Analyzer produces frames that have different locals than those detected by JRE bytecode verifier Invalid stackmap generated when the instruction stream has new instruction after invokespecial to <init> Analyzer can fail to catch thrown exceptions asm-analysis Frame allocates an array unnecessarily inside executeInvokeInsn Fixed bug in CheckFrameAnalyzer with static methods

Changes of version 9.5:

New Opcodes.V21 constant for Java 21

New readBytecodeInstructionOffset hook in ClassReader Added more detailed exception messages

Javadoc improvements and fixes

Bugs fixed:

Silent removal of zero-valued entries from the line-number table

Changes of version 9.4:

Changes:

New Opcodes.V20 constant for Java 20 Added more checks in CheckClassAdapter Javadoc improvements and fixes module-info classes can be built without Gradle and Bnd Parent POM updated to org.ow2:ow2:1.5.1

Bugs fixed: +CheckClassAdapter is no longer transparent for MAXLOCALS + Added public getDelegate method to all visitor classes + Analyzer does not compute optimal maxLocals for static methods + Fixed SignatureWriter when a generic type has a depth over 30 + Skip remap inner class name if not changed in Remapper maven-archiver was updated from version 3.5.0 to 3.6.1: Changes of 3.6.1:

New Features:

Deprecated the JAR Index feature (JDK-8302819)

Task:

Refreshed download page Prefer JDK features over plexus-utils, plexus-io

Changes of 3.6.0:

Task:

Require Java 8 Drop m-shared-utils from deps maven-assembly-plugin was updated from version 3.3.0 to 3.6.0: Changes of 3.6.0:

Bugs fixed:

finalName as readonly parameter makes common usecases very complicated Symbolic links get copied with absolute path Warning if using Maven 3.9.1 Minimal default Manifest configuration of jar archiver should be respected

New Features:

Support Zstandard compression format

Improvements:

In RB mode, apply 022 umask to ignore environment group write umask Added system requirements history

Task:

Dropped deprecated repository element Support running build on Java 20 Refresh download page Cleanup declared dependencies Avoid using deprecated methods of plexus-archiver

Changes of 3.5.0:

Bugs fixed:

File permissions removed during assembly:single since 3.2.0

Changes of 3.4.2:

Bugs fixed:

Fixed Excludes filtering

Task:

Fixed examples to refer to https instead of http

Changes of 3.4.1:

Bugs fixed:

Fixed error build with shared assemblies

Changes of 3.4.0:

Bugs fixed:

dependencySet includes filter with classifier breaks include of artifacts without classifier

Task:

Speed improvements Update plugin (requires Maven 3.2.5+) Assembly plugin resolves too much, even plugins used to build dependencies Deprecated the repository element in assembly descriptor Upgraded to Java 8, drop unused dependencies maven-common-artifact-filters was updated from version 3.0.1 to 3.3.2: Changes of 3.3.2:

Bugs fixed:

PatternIncludesArtifactFilters raising NPE for patterns w/ wildcards and artifactoid w/ null on any coordinate

Changes of 3.3.1:

Bugs fixed:

Pattern w/ 4 elements may be GATV or GATC

Changes of 3.3.0:

Bugs fixed:

null passed to DependencyFilter in EclipseAetherFilterTransformerTest PatternIncludesArtifactFilter#include(Artifact) Common Artifact Filters pattern parsing with classifier is broken

Task:

Sanitized dependencies Upgraded to Maven Parent 36, to Maven 3.2.5, to Java 8 and clean up dependencies

Changes of 3.2.0:

Improvements:

Big speed improvements for patterns that do not contain any wildcard

Changes of 3.1.1:

Bugs fixed:

Updated JIRA URL for maven-common-artifact-filters

Improvements:

Made build Reproducible

Changes of 3.1.0:

Bugs fixed:

Several filters do not preserve order of artifacts filtered maven-compiler-plugin was updated from version 3.10.1 to 3.11.0: Changes of 3.11.0: New features and improvements:

Added a useModulePath switch to the testCompile mojo Allow dependency exclusions for 'annotationProcessorPaths' Use maven-resolver to resolve 'annotationProcessorPaths' dependencies Upgrade plexus-compiler to improve compiling message compileSourceRoots parameter should be writable Change showWarnings to true by default Warn about warn-config conflicting values Update default source/target from 1.7 to 1.8 Display recompilation causes Added some parameter to pattern from stale source calculation Added dedicated option for implicit javac flag

Bugs fixed:

Fixed incorrect detection of dependency change Test with Maven 3.9.0 and fix the failing IT Resolved all annotation processor dependencies together Defining maven.compiler.release as empty string ends with NumberFormatException in testCompileMojo Fixed missing dirs in createMissingPackageInfoClasses Set Xcludes in config passed to actual compiler maven-dependency-analyzer was updated from version 1.10 to 1.13.2: Changes of 1.13.2:

Changes and bugs fixed:

Made mvn dependency:analyze work with OpenJDK 11 Fixed jdk8 incompatibility at runtime (NoSuchMethodError) Upgraded asm to 8.0.1 Use try with resources to avoid leaks dependency:analyze recommends test scope for test-only artifacts that have non-test scope remove reference to deprecated public mutable field Updated JIRA URL dependency:analyze should recommend narrower scope where possible Remove dependency on jmock Inline deprecated field Added more JavaDoc Handle different classes from same artifact used by model and test code Included class names in used undeclared dependencies Check maximum allowed Maven version Get rid of maven-plugin-testing-tools for IT test Require Maven 3.2.5+ Analyze project classes only once Fixed array parsing CONSTANTMETHODTYPE should not add to classes Inner classes are in same compilation unit as container class Upgraded Parent to 36 Cleanup IT tests Replace Codehaus Plexus utils with java.nio.file.Files and Apache Commons Fixed bug with "non-test scoped test only dependencies found" Bump asm from 9.4 to 9.5 Refresh download page Upgrade Parent to 39 Build on JDK 19, 20 Prefer JDK classes to Plexus utils Replaced System.out by logger Fixed java.lang.RuntimeException: Unknown constant pool type Switched to JUnit 5 Dependency improvements maven-dependency-plugin was updated from version 3.1.2 to 3.6.0: Changes in 3.6.0:

Bugs fixed:

Obsolete example of -Dverbose on web page Unsupported verbose option still appears in docs dependency:go-offline does not use repositories from parent pom in reactor build Fixed possible NPE dependency:analyze-only goal fails on OpenJDK 14 FileWriter and FileReader should be replaced Dependency Plugin go-offline doesn't respect artifact classifier analyze-only failed: Unsupported class file major version 60 (Java 16) analyze-only failed: Unsupported class file major version 61 (Java 17) copy-dependencies fails when using excludeScope=test mvn dependency:analyze detected wrong transitive dependency dependency plugin does not work with JDK 16 skip dependency analyze in ear packaging Non-test dependency reported as Non-test scoped test only dependency 'Dependency not found' with 3.2.0 and Java-17 while analyzing Tree plugin does not terminate with 3.2.0 Minor improvement - continue analyze-only failed: PermittedSubclasses requires ASM9 Broken Link to "Introduction to Dependency Mechanism Page" Sealed classes not supported Dependency tree in verbose mode for war is empty Javadoc was not updated to reflect that :tree's verbose option is now ok error dependency:list (caused by postgresql dependency) :list-classes does not skip if skip is set :list-classes does not use GAV parameters

New Features:

Reintroduce the verbose option for dependency:tree List classes in a given artifact dependency:analyze should recommend narrower scope where possible Added analyze parameter "ignoreUnusedRuntime" Allow ignoring non-test-scoped dependencies Added a <stripType> option to unpack goals Allow auto-ignore of all non-test scoped dependencies used only in test scope

Improvements:

Unused method o.a.m.p.d.t.TreeMojo.containsVersion Minor improvements GitHub Action build improvement dependency:analyze should list the classes that cause a used undeclared dependency Improve documentation of analyze - Non-test scoped Turn warnings into errors instead of failOnWarning maven-dependency-plugin should leverage plexus-build-api to support IDEs TestListClassesMojo logs too much Use outputDirectory from AbstractMavenReport Removed not used dependencies / Replace parts list-repositories - improvements warns about depending on plexus-container-default Replace AnalyzeReportView with a new AnalyzeReportRenderer

Task:

Removed no longer required exclusions Java 1.8 as minimum Explicitly start and end tables with Doxia Sinks in report renderers Replace Maven shared StringUtils with Commons Lang3 Removed unused and ignored parameter - useJvmChmod Removed custom plexus configuration Code refactor - UnpackUtil Refresh download page maven-dependency-tree was updated from version 3.0.1 to 3.2.1: Changes in 3.2.1:

Bugs fixed:

DependencyCollectorBuilder does not collect dependencies when artifact has 'war' packaging Transitive provided dependencies are not removed from collected dependency graph

New Features:

DependencyCollectorBuilder more configurable

Improvements:

DependencyGraphBuilder does not provide verbose tree DependencyGraphBuilders shouldn't need reactorProjects for resolving dependencies Maven31DependencyGraphBuilder should not download dependencies other than the pom Fixed plexus-component-annotation in line with plexus-component-metadata Upgraded parent to 31 Added functionality to collect raw dependencies in Maven 3+ Annotate DependencyNodes with dependency management metadata Require Java 8 Upgrade org.eclipse.aether:aether-util dependency in org.apache.maven.shared:maven-dependency-tree Added Exclusions to DependencyNode Made build Reproducible Migrate plexus component to JSR-330 Drop maven 3.0 compatibility

Dependency upgrade:

Upgrade shared-component to version 33 Upgrade Parent to 36 Bump maven-shared-components from 36 to 37

Removed unnecessary dependency on xmvn tools and parent pom maven-enforcer was updated to version 3.4.1: Update to version 3.4.1:

Bugs fixed:

In a multi module project "bannedDependencies" rule tries to resolve project artifacts from external repository Require Release Dependencies ignorant about aggregator build banDuplicatePomDependencyVersions does not check managementDependencies Beanshell rule is not thread-safe RequireSnapshotVersion not compatible with CI Friendly Versions (${revision}) NPE when using new <?m2e execute ?> syntax with maven-enforcer-plugin Broken links on Maven Enforcer Plugin site RequirePluginVersions not recognizing versions-from-properties [REGRESSION] RequirePluginVersions fails when versions are inherited requireFilesExist rule should be case sensitive Broken Links on Project Home Page TestRequireOS uses hamcrest via transitive dependency plexus-container-default in enforcer-api is very outdated classifier not included in output of failes RequireUpperBoundDeps test Exclusions are not considered when looking at parent for requireReleaseDeps requireUpperBoundDeps does not fail when packaging is 'war' DependencyConvergence in 3.0.0 fails on provided scoped dependencies NPE on requireReleaseDeps with non-matching includes RequireUpperBoundDeps now follow scope provided transitive dependencies Use currently build artifacts in IT tests requireReleaseDeps does not support optional dependencies or runtime scope Enforcer 3.0.0 breaks with Maven 3.8.4 Version 3.1.0 is not enforcing bannedDependencies rules DependencyConvergence treats provided dependencies are runtime dependencies Plugin shouldn't use NullPointerException for non-exceptional code flow NPE in RequirePluginVersions ReactorModuleConvergence not cached in reactor RequireUpperBoundDeps fails on provided dependencies since 3.2.1 Problematic dependency resolution by new 'banDynamicVersions' rule banTransitiveDependencies: failing if a transitive dependencies has another version than the resolved one Filtering dependency tree by scope Upgrading to 3.0.0 causes 'Could not build dependency tree' with repositories some unknown protocol DependencyConvergence in 3.1.0 fails when using version ranges Semantics of 'ignores' parameter of 'banDynamicVersions' is inverted Omission of 'excludedScopes' parameter of 'banDynamicVersions' causes NPE ENFORCER: plugin-info and mojo pages not found

New Features:

requireUpperBounds deps should have includes Introduce RequireTextFileChecksum with line separator normalization allow no rules show rules processed DependencyConvergence should support including/excluding certain dependencies Support declaring external banned dependencies in an external file/URL Maven enforcer rule which checks that all dependencies have an explicit scope set Maven enforcer rule which checks that all dependencies in dependencyManagement don't have an explicit scope set Rule for no version ranges, version placeholders or SNAPSHOT versions Allow one of many files in RequireFiles rules to pass Skip specific rules New Enforcer API New Enforcer API - RuleConfigProvider Move Built-In Rules to new API

Improvements:

wildcard ignore in requireReleaseDeps Improve documentation about writing own Enforcer Rule RequireActiveProfile should respect inherited activated profiles Upgrade maven-dependency-tree to 3.x Improve dependency resolving in multiple modules project requireUpperBoundDeps: add [<scope>] and colors to the output Example for writing a custom rule should be upgraded Along with JavaVersion, allow enforcement of the JavaVendor Included Java vendor in display-info output requireMavenVersion x.y.z is processed as (,x.y.z] instead of [x.y.z,) Consistently format artifacts same as dependency:tree Made build Reproducible Added support for excludes/includes in requireJavaVendor rule Introduce Maven Enforcer Extension Extends RequirePluginVersions with banMavenDefaults Shared GitHub Actions Log at ERROR level when <fail> is set Reuse getDependenciesToCheck results across rules Violation messages can be really hard to find in a multi module project Clarify class loading for custom Enforcer rules Using junit jupiter bom instead of single artifacts. Get rid of maven-dependency-tree dependency Allow 8 as JDK version for requireJavaVersion Improve error message for rule "requireJavaVersion" Include Java Home in Message for Java Rule Failures Manage all Maven Core dependencies as provided Mange rules configuration by plugin Deprecate 'rules' property and introduce 'enforcer.rules' as a replacement Change success message from executed to passed EnforcerLogger: Provide isDebugEnabled(), isErrorEnabled(), isWarnEnabled() and isInfoEnabled() Properly declare dependencies

Test:

Regression test for dependency convergence problem fixed in 3.0.0

Task:

Removed reference to travis or switch to travis.com Fixed maven assembly links Require Java 8 Verify working with Maven 4 Code cleanup Refresh download page Deprecate display-info mojo Refresh site descriptors Superfluous blanks in BanDuplicatePomDependencyVersions Rename ResolveUtil to ResolverUtil maven-plugin-tools was updated from version 3.6.0 to version 3.9.0: Changes of version 3.9.0:

Bugs fixed:

Fixed -mojo.xml (in PluginXdocGenerator) is overwritten when multiple locales are defined Generated table by PluginXdocGenerator does not contain default attributes

Improvements:

Omit empty line in generated help goal output if plugin description is empty Use Plexus I18N rather than fiddling with

Task:

Removed reporting from maven-plugin-plugin: create maven-plugin-report-plugin

Dependency upgrade:

Upgrade plugins and components (in ITs)

Changes of version 3.8.2:

Improvements:

Used Resolver API, get rid of localRepository

Dependency upgrade:

Bump httpcore from 4.4.15 to 4.4.16 Bump httpclient from 4.5.13 to 4.5.14 Bump antVersion from 1.10.12 to 1.10.13 Bump slf4jVersion from 1.7.5 to 1.7.36 Bump plexus-java from 1.1.1 to 1.1.2 Bump plexus-archiver from 4.6.1 to 4.6.3 Bump jsoup from 1.15.3 to 1.15.4 Bump asmVersion from 9.4 to 9.5 Bump assertj-core from 3.23.1 to 3.24.2

Changes of version 3.8.1:

Bugs fixed:

Javadoc reference containing a link label with spaces are not detected JavadocLinkGenerator.createLink: Support nested binary class names ERROR during build of m-plugin-report-p and m-plugin-p: Dependencies in wrong scope "Executes as an aggregator plugin" documentation: s/plugin/goal/ Maven scope warning should be logged at WARN level Fixed Temporary File Information Disclosure Vulnerability

New features:

Support mojos using the new maven v4 api

Improvements:

Plugin descriptor should contain the requiredJavaVersion/requiredMavenVersion Execute annotation only supports standard lifecycle phases due to use of enum Clarify deprecation of all extractors but the maven-plugin-tools-annotations

Dependency upgrade:

Update to Maven Parent POM 39 Bump junit-bom from 5.9.1 to 5.9.2 Bump plexus-archiver from 4.5.0 to 4.6.1

Changes of version 3.7.1:

Bugs fixed:

Maven scope warning should be logged at WARN level

Changes of version 3.7.0:

Bugs fixed:

The plugin descriptor generated by plugin:descriptor does not consider @ see javadoc taglets Report-Mojo doesn't respect input encoding Generating site reports for plugin results in NoSuchMethodError JDK Requirements in plugin-info.html: Consider property "maven.compiler.release" Parameters documentation inheriting @ since from Mojo can be confusing Don't emit warning for missing javadoc URL of primitives Don't emit warning for missing javadoc URI if no javadoc sources are configured Parameter description should be taken from annotated item

New Features:

Added link to javadoc in configuration description page for user defined types of Mojos. Allow only @ Deprecated annotation without @ deprecated javadoc tag add system requirements history section report: allow to generate usage section in plugin-info.html with true Allow @ Parameter on setters methods Extract plugin report into its own plugin report: Expose generics information of Collection and Map types

Improvement:

plugin-info.html should contain a better Usage section Do not overwrite generate files with no content change Upgrade to JUnit 5 and @ Inject annotations Support for java 20 - ASM 9.4 Don't print empty Memory, Disk Space in System Requirements simplification in helpmojo build Get rid of plexus-compiler-manager from tests Use Maven core artifacts in provided scope report and descriptor goal need to evaluate Javadoc comments differently Allow to reference aggregator javadoc from plugin report

Task:

Detect legacy/javadoc Mojo definitions, warn to use Java 5 annotations Update level to Java 8 Deprecate scripting support for mojos Deprecate requirements parameter in report Mojo Removed duplicate code from PluginReport Prepare for Doxia (Sitetools) 2.0.0 Fixed documentation for maven-plugin-report-plugin Removed deprecated items from new maven-plugin-report-plugin Improve site build Improve dependency management Plugin generator generation fails when the parent class comes from a different project

Dependency upgrade:

Upgrade Maven Reporting API/Impl to 3.1.0 Upgrade Parent to 36 Upgrade project dependencies after JDK 1.8 Bump maven-parent from 36 to 37 Upgrade Maven Reporting API to 3.1.1/Maven Reporting Impl to 3.2.0 Upgrade plexus-utils to 3.5.0

Changes of version 3.6.4:

Restored compatibility with Maven 3 ecosystem

Upgraded dependencies

Changes of version 3.6.3:

Added prerequisites to plugin pom

Exclude dependency in provided scope from plugin descriptor Get rid of String.format use Fixed this logging as well Simplify documentation

Exclude maven-archiver and maven-jxr from warning

Changes of version 3.6.2:

Deprecated unused requiresReports flag

Check that Maven dependencies are provided scope Update ITs Use shared gh action Deprecate unsupported Mojo descriptor items Weed out ITs Upgrade to maven 3.x and avoid using deprecated API Drop legacy dependencies Use shared gh action - v1

Fixed wording in javadoc

Changes of version 3.6.1:

What's Changed:

Added missing @OverRide and make methods static Upgraded to JUnit 4.12 Upgraded parent POM and other dependencies Updated plugins Upgraded Doxia Sitetools to 1.9.2 to remove dependency on Struts removed Maven 2 info Removed unneeded dependency Tighten the dependency tree Ignore .checkstyle Strict dependencies for maven-plugin-tools-annotations Improved @execute(goal...) docs Improve @execute(lifecycle...) docs plexus-compiler was updated from version 2.11.1 to 2.14.2: Changes of 2.14.2:

Removed:

Drop J2ObjC compiler

New features and improvements:

Update AspectJ Compiler to 1.9.21 to support Java 21 Require JDK 17 for build Improve locking on JavacCompiler Include 'parameter' and 'preview' describe log Switch to SISU annotations and plugin, fixes #217 Support jdk 21 Require Maven 3.5.4+ Require Java 11 for plexus-compiler-eclipse an javac-errorprone and aspectj compilers Added support to run its with Java 20

Bugs fixed:

Fixed javac memory leak Validate zip file names before extracting (Zip Slip) Restore AbstractCompiler#getLogger() method Return empty list for not existing source root location Improve javac error output parsing

Changes of 2.13.0:

New features and improvements:

Fully ignore any possible jdk bug MCOMPILER-402: Added implicitOption to CompilerConfiguration Added a custom compile argument replaceProcessorPathWithProcessorModulePath to force the plugin replace processorPath with processormodulepath describe compiler configuration on run simplify "Compiling" info message: display relative path

Bugs fixed:

Respect CompilerConfiguration.sourceFiles in EclipseJavaCompiler Avoid NPE in AspectJCompilerTest on AspectJ 1.9.8+

Dependency updates:

Bump maven-surefire-plugin from 3.0.0-M5 to 3.0.0-M6 Bump errorpronecore from 2.11.0 to 2.13.1 Bump github/codeql-action from 1 to 2 Bump ecj from 3.28.0 to 3.29.0 Bump release-drafter/release-drafter from 5.18.1 to 5.19.0 Bump ecj from 3.29.0 to 3.30.0 Bump maven-invoker-plugin from 3.2.2 to 3.3.0 Bump maven-enforcer-plugin from 3.0.0 to 3.1.0 Bump errorpronecore from 2.13.1 to 2.14.0 Bump maven-surefire-plugin from 3.0.0-M6 to 3.0.0-M7 Bump ecj from 3.31.0 to 3.32.0 Bump junit-bom from 5.9.0 to 5.9.1 Bump ecj from 3.30.0 to 3.31.0 Bump groovy from 3.0.12 to 3.0.13 Bump groovy-json from 3.0.12 to 3.0.13 Bump groovy-xml from 3.0.12 to 3.0.13 Bump animal-sniffer-maven-plugin from 1.21 to 1.22 Bump errorpronecore from 2.14.0 to 2.15.0 Bump junit-bom from 5.8.2 to 5.9.0 Bump groovy-xml from 3.0.11 to 3.0.12 Bump groovy-json from 3.0.11 to 3.0.12 Bump groovy from 3.0.11 to 3.0.12

Maintenance:

Require Maven 3.2.5

This update for postgresql13 fixes the following issues: Upgrade to 13.14: CVE-2024-0985: Tighten security restrictions within REFRESH MATERIALIZED VIEW CONCURRENTLY (bsc#1219679).

This update for postgresql12 fixes the following issues: Upgrade to 12.18: CVE-2024-0985: Tighten security restrictions within REFRESH MATERIALIZED VIEW CONCURRENTLY (bsc#1219679).

This update for webkit2gtk3 fixes the following issues: Update to version 2.42.5 (bsc#1219604): CVE-2024-23222: Fixed processing maliciously crafted web content that may have led to arbitrary code execution (bsc#1219113). CVE-2024-23206: Fixed fingerprint user via maliciously crafted webpages (bsc#1219604). CVE-2024-23213: Fixed processing web content that may have led to arbitrary code execution (bsc#1219604). CVE-2023-40414: Fixed processing web content that may have led to arbitrary code execution (bsc#1219604). CVE-2014-1745: Fixed denial-of-service or potentially disclose memory contents while processing maliciously crafted files (bsc#1219604). CVE-2023-42833: Fixed processing web content that may have led to arbitrary code execution (bsc#1219604).

This update for salt fixes the following issues: Security issues fixed: CVE-2024-22231: Prevent directory traversal when creating syndic cache directory on the master (bsc#1219430) CVE-2024-22232: Prevent directory traversal attacks in the master's servefile method (bsc#1219431) Bugs fixed: Ensure that pillar refresh loads beacons from pillar without restart Fix the aptpkg.py unit test failure Prefer unittest.mock to python-mock in test suite Enable "KeepAlive" probes for Salt SSH executions (bsc#1211649) Revert changes to set Salt configured user early in the stack (bsc#1216284) Align behavior of some modules when using salt-call via symlink (bsc#1215963) Fix gitfs "env" and improve cache cleaning (bsc#1193948) Remove python-boto dependency for the python3-salt-testsuite package for Tumbleweed

This update for tomcat fixes the following issues: Updated to Tomcat 9.0.85: CVE-2023-45648: Improve trailer header parsing (bsc#1216118). CVE-2023-42794: FileUpload: remove tmp files to avoid DoS on Windows (bsc#1216120). CVE-2023-42795: Improve handling of failures during recycle() methods (bsc#1216119). CVE-2023-46589: Fixed HTTP request smuggling due to incorrect headers parsing (bsc#1217649) CVE-2024-22029: Fixed escalation to root from tomcat user via %post script. (bsc#1219208) The following non-security issues were fixed: Fixed the file permissions for server.xml (bsc#1217768, bsc#1217402). Find the full release notes at: https://tomcat.apache.org/tomcat-9.0-doc/changelog.html

This update for spack fixes the following issues: spack was updated to version 0.21.1 (bsc#1219480): Version 0.21.1:

Add support for reading buildcaches created by Spack v0.22

Bugfixes:

spack graph: fix coloring with environments spack info: sort variants in --variants-by-name Spec.format: error on old style format strings

ASP-based solver:

fix infinite recursion when computing concretization errors

don't error for type mismatch on preferences

don't emit spurious debug output.

Improve the error message for deprecated preferences

Fix multi-word aliases Add a warning for unconfigured compiler environment: fix an issue with deconcretization/reconcretization of specs buildcache: don't error if a patch is missing, when installing from binaries

Version 0.21.0:

New features:

Better error messages with condition chaining: In v0.18, we added better error messages that could tell you what problem happened, but they couldn't tell you why it happened. 0.21 adds condition chaining to the solver, and Spack can now trace back through the conditions that led to an error and build a tree of causes potential causes and where they came from.

OCI build caches: You can now use an arbitrary OCI registry as a build cache:

For Dockerhub: $ spack mirror add myregistry oci://user/image

For another registry (GHCR): $ spack mirror add myregistry oci://ghcr.io/haampie/spack-test

Then set the login credentials: $ spack mirror set --push --oci-username ... --oci-password ... myregistry and push to it: $ spack buildcache push myregistry [specs...] You can optionally add a base image to get runnable images: $ spack buildcache push --base-image leap:15.5 myregistry python Pushed ... as [image]:python-3.11.2-65txfcpqbmpawclvtasuog4yzmxwaoia.spack $ docker run --rm -it [image]:python-3.11.2-65txfcpqbmpawclvtasuog4yzmxwaoia.spack This creates a container image from the Spack installations on the host system, without the need to run spack install from a Dockerfile or sif file. It also addresses the inconvenience of losing binaries of dependencies when RUN spack install fails inside docker build. Further, the container image layers and build cache tarballs are the same files. This means that spack install and docker pull use the exact same underlying binaries. If you previously used spack install inside of docker build, this feature helps you save storage by a factor two. + Multiple versions of build dependencies: Increasingly, complex package builds require multiple versions of some build dependencies. For example, Python packages frequently require very specific versions of setuptools, cython, while different physics packages require different versions of Python to build. The concretizer enforced that every solve was unified, i.e., so that there was only one version of every package. The concretizer now supports "duplicate" nodes for build dependencies, but enforces unification through transitive link and run dependencies. This will allow it to better resolve complex dependency graphs in ecosystems like Python. + Cherry-picking virtual dependencies: You can now select only a subset of virtual dependencies from a spec that may provide more. For example, to make mpich your mpi provider, you can be explicit by writing: hdf5 ^[virtuals=mpi] mpich Or, to use, e.g., intel-parallel-studio for blas along with an external lapack like openblas, you could write: strumpack ^[virtuals=mpi] intel-parallel-studio+mkl ^[virtuals=lapack] openblas The virtuals=mpi is an edge attribute, and dependency edges in Spack graphs now track which virtuals they satisfied. + The spack deconcretize command gives you control over what you want to update in an already concrete environment. As an example, with an environment built with meson, and you want to update your meson version, you can run: $spack deconcretize meson and have everything that depends on meson rebuilt the next time you run spack concretize. In the future, we'll handle this in a single command, but for now you can use this to drop bits of your lockfile and resolve your dependencies again. + UI Improvements: The spack info received a rework to make the output more appealing. It is now on par with the rest of Spack's UI. spack info now makes much better use of terminal space and shows variants, their values, and their descriptions more clearly. Conditional variants are grouped separately so you can more easily understand how packages are structured. spack checksum now allows you to filter versions from your editor, or by version range. It also notifies you about potential download URL changes. + Environments can include definitions: Spack did not previously support using include: with The definitions section of an environment, but now it does. You can use this to curate lists of specs and more easily reuse them across environments. + Aliases: You can now add aliases to Spack commands in config.yaml, e.g. this might enshrine your favorite args to spack find as spack f: config: aliases: f: find -lv

Improved autoloading of modules: In this release, you can start using hideimplicits: true instead, which exposes only explicitly installed packages to the user, while still autoloading dependencies. On top of that, you can safely use hashlength: 0, as this config now only applies to the modules exposed to the user -- you don't have to worry about file name clashes for hidden dependencies. Note: for Tcl this feature requires Modules 4.7 or higher

Other new commands and directives:

spack env activate without arguments now loads a default environment that you do not have to create. spack find -H / --hashes: a new shortcut for piping spack find output to other commands. Add spack checksum --verify, fix --add. New defaultargs context manager factors out common args for directives. spack compiler find --[no]-mixed-toolchain lets you easily mix clang and gfortran on Linux

Performance improvements:

spack external find execution is now much faster. spack location -i is now much faster on success. Drop redundant rpaths post install. ASP-based solver: avoid cycles in clingo using hidden directive. Fix multiple quadratic complexity issues in environments

Other new features of note:

archspec: update to v0.2.2, support for Sapphire Rapids, Power10, Neoverse V2. Propagate variants across nodes that don't have that variant Implement fish shell completion. Can now distinguish between source/binary mirror; don't ping mirror.spack.io as much. Improve status reporting on spack install (add [n/total] display...).

This update for suse-build-key fixes the following issues: This update runs a import-suse-build-key script. The previous libzypp-post-script based installation is replaced with a systemd timer and service (bsc#1217215 bsc#1216410 jsc#PED-2777). - suse-build-key-import.service - suse-build-key-import.timer It imports the future SUSE Linux Enterprise 15 4096 bit RSA key primary and reserve keys. After successful import the timer is disabled. To manually import them you can also run: rpm --import /usr/lib/rpm/gnupg/keys/gpg-pubkey-3fa1d6ce-63c9481c.asc rpm --import /usr/lib/rpm/gnupg/keys/gpg-pubkey-d588dc46-63c939db.asc Bugfix added since last update: run rpm commands in import script only when libzypp is not active. bsc#1219189 bsc#1219123

This update for scap-security-guide fixes the following issues: updated to 0.1.71 (jsc#ECO-3319) Add RHEL 9 STIG Add support for Debian 12 Update PCI-DSS profile for RHEL lots of bugfixes and improvements for SLE removed left over file, patch upstreamed in 0.1.69

This update for supportutils fixes the following issues: Update to version 3.1.28 Correctly detects Xen Dom0 (bsc#1218201) Fixed smart disk error (bsc#1218282) Remove supportutils requires for util-linux-systemd and kmod (bsc#1193173) Added missing klp information to kernel-livepatch.txt (bsc#1216390) Fixed plugins creating empty files when using supportconfig.rc (bsc#1216388) Provides long listing for /etc/sssd/sssd.conf (bsc#1211547) Optimize lsof usage (bsc#1183663) Collects chrony or ntp as needed (bsc#1196293) Fixed podman display issue (bsc#1217287) Added nvme-stas configuration to nvme.txt (bsc#1216049) Added timed command to fs-files.txt (bsc#1216827) Collects zypp history file issue#166 (bsc#1216522)

This update for bouncycastle, jsch fixes the following issues: Updated jsch to version 0.2.15:

CVE-2023-48795: Fixed a prefix truncation issue that could lead to disclosure of sensitive information (bsc#1218134).

Updated bouncycastle to version 1.77.

This update for perl fixes the following issues: CVE-2023-31484: Enable TLS cert verification in CPAN (bsc#1210999).

This update for webkit2gtk3 fixes the following issues: CVE-2024-23222: Fixed type confusion that may lead to arbitrary code execution. (bsc#1219113)

This update for slurm2205 fixes the following issues: Update to slurm 22.05.11: Security fixes: CVE-2023-49933: Prevent message extension attacks that could bypass the message hash. (bsc#1218046) CVE-2023-49936: Prevent NULL pointer dereference on sizevalp overflow. (bsc#1218050) CVE-2023-49937: Prevent double-xfree() on error in unpacknoderegresp(). (bsc#1218051) CVE-2023-49938: Prevent modified sbcast RPCs from opening a file with the wrong group permissions. (bsc#1218053) Other fixes: Add missing service file for slurmrestd (bsc#1217711). Fix slurm upgrading to incompatible versions (bsc#1216869).

This update for xen fixes the following issues: CVE-2023-46839: Fixed phantom functions assigned to incorrect contexts (XSA-449) (bsc#1218851)