Packages changed:
  argyllcms
  blog
  bluez
  cairo
  dbus-1 (1.10.20 -> 1.12.2)
  dbus-1-x11 (1.10.20 -> 1.12.2)
  evince
  gnome-terminal
  harfbuzz (1.7.1 -> 1.7.2)
  hfsutils
  installation-images-Kubic (14.347 -> 14.349)
  kernel-source (4.14.5 -> 4.14.6)
  kf5-filesystem
  libqt5-qttranslations (5.9.2 -> 5.9.3)
  libqt5-qtvirtualkeyboard (5.9.2 -> 5.9.3)
  manufacturer-PPDs
  perl-Text-CSV_XS (1.32 -> 1.34)
  pinentry (1.0.0 -> 1.1.0)
  postgresql
  tiff (4.0.8 -> 4.0.9)
  tigervnc
  vte
  xf86-video-ati
  xorg-x11-server

=== Details ===

==== argyllcms ====

- replace xorg-x11-devel by the needed individual libraries.

==== blog ====

- hardening of the console list generation (bsc#1071568):
  * libconsole-never-return-empty-list-from-getconsoles.patch
  * libconsole-Really-allow-to-use-dev-console-as-a-fall.patch
  * libconsole-Add-console-into-the-list-only-when-succe.patch
  * libconsole-Correctly-ignore-early-consoles.patch

==== bluez ====
Subpackages: bluez-cups bluez-devel libbluetooth3

- add 0001-obexd-use-AM_LDFLAGS-for-linking.patch
- document systemd dependency during %post

==== cairo ====
Subpackages: cairo-devel libcairo-gobject2 libcairo-script-interpreter2 libcairo2 libcairo2-32bit

- Depend on pkgconfig(gl) and pkgconfig(egl) instead of Mesa-devel.
  * The pkgconfig(gl) and pkgconfig(egl) are what cairo really
    needs. Mesa-devel is too general and is a bottleneck in
    distribution build. (bnc#1071297)

==== dbus-1 ====
Version update (1.10.20 -> 1.12.2)
Subpackages: dbus-1-devel libdbus-1-3 libdbus-1-3-32bit

- Swap a missed libdir to libexecdir
- Do not hide errors during useradd.
- Fix dbus-daemon-launch-helper to use proper ref to libexecdir
- use %{_libexecdir}/dbus-1 as libexecdir
- Update to 1.12.2
  Deprecations:
  ? Eavesdropping is officially deprecated in favour of BecomeMonitor.
  See the release notes for spec version 0.31 (in dbus 1.11.14).
  ? [Unix] Flag files in /var/run/console/${username} are deprecated.
  See the release notes for 1.11.18.
  New APIs:
  ? <allow> and <deny> rules in dbus-daemon configuration can now
  include send_broadcast="true", send_broadcast="false",
  max_unix_fds="N", min_unix_fds="N" (for some integer N).
  See the release notes for 1.11.18.
  ? dbus_try_get_local_machine_id() is like
  dbus_get_local_machine_id(), but returns a DBusError.
  ? New APIs around DBusMessageIter to simplify cleanup.
  See the release notes for 1.11.16.
  ? The message bus daemon now implements the standard Introspectable,
  Peer and Properties interfaces. See the release notes for
  dbus 1.11.14 and spec version 0.31.
  ? DTDs for introspection XML and bus configuration are installed.
  ? [Unix] A new unix:dir=? address family resembles unix:tmpdir=? but
  never uses Linux abstract sockets, which is advantageous for
  containers. On non-Linux it is equivalent to unix:tmpdir=?.
  See the release notes for dbus 1.11.14 and spec version 0.31.
  ? [Unix] New option "dbus-launch --exit-with-x11".
  ? [Unix] Session managers can create transient .service files in
  $XDG_RUNTIME_DIR/dbus-1/services. See the release notes for 1.11.12.
  ? [Unix] A sysusers.d snippet can create the messagebus user on-demand.
  Miscellaneous behaviour changes:
  ? [Unix] The session bus now logs to syslog if it was started by
  dbus-launch.
  ? [Unix] Internal warnings are logged to syslog if configured.
  ? [Unix] Exceeding an anti-DoS limit is logged to syslog if configured,
  or to stderr.
- Enabled "make check test suite"
- Patches removed, fixed upstream
  * fix-upstream-drop-install-sections-from-user-services.patch
  * fix-upstream-increase-backlog.patch
  * fix-upstream-timeout-reset-1.patch
  * fix-upstream-timeout-reset-2.patch
- boo#1027201 dbus-daemon not found
- boo#978477 systemd reseting under heavy load
  * fix-upstream-timeout-reset-1.patch
  * fix-upstream-timeout-reset-2.patch
- boo#1027200 don't generate machine-id in %post systemd will do it
  on first boot.
- swap usage of /bin/false to /usr/bin/false
- Use libexecdir=%{_libdir}/dbus-1 rather then /lib/dbus-1

==== dbus-1-x11 ====
Version update (1.10.20 -> 1.12.2)

- Swap a missed libdir to libexecdir
- Do not hide errors during useradd.
- use %{_libexecdir}/dbus-1 as libexecdir
- Update to 1.12.2
  Deprecations:
  ? Eavesdropping is officially deprecated in favour of BecomeMonitor.
  See the release notes for spec version 0.31 (in dbus 1.11.14).
  ? [Unix] Flag files in /var/run/console/${username} are deprecated.
  See the release notes for 1.11.18.
  New APIs:
  ? <allow> and <deny> rules in dbus-daemon configuration can now
  include send_broadcast="true", send_broadcast="false",
  max_unix_fds="N", min_unix_fds="N" (for some integer N).
  See the release notes for 1.11.18.
  ? dbus_try_get_local_machine_id() is like
  dbus_get_local_machine_id(), but returns a DBusError.
  ? New APIs around DBusMessageIter to simplify cleanup.
  See the release notes for 1.11.16.
  ? The message bus daemon now implements the standard Introspectable,
  Peer and Properties interfaces. See the release notes for
  dbus 1.11.14 and spec version 0.31.
  ? DTDs for introspection XML and bus configuration are installed.
  ? [Unix] A new unix:dir=? address family resembles unix:tmpdir=? but
  never uses Linux abstract sockets, which is advantageous for
  containers. On non-Linux it is equivalent to unix:tmpdir=?.
  See the release notes for dbus 1.11.14 and spec version 0.31.
  ? [Unix] New option "dbus-launch --exit-with-x11".
  ? [Unix] Session managers can create transient .service files in
  $XDG_RUNTIME_DIR/dbus-1/services. See the release notes for 1.11.12.
  ? [Unix] A sysusers.d snippet can create the messagebus user on-demand.
  Miscellaneous behaviour changes:
  ? [Unix] The session bus now logs to syslog if it was started by
  dbus-launch.
  ? [Unix] Internal warnings are logged to syslog if configured.
  ? [Unix] Exceeding an anti-DoS limit is logged to syslog if configured,
  or to stderr.
- Enabled "make check test suite"
- Patches removed, fixed upstream
  * fix-upstream-drop-install-sections-from-user-services.patch
  * fix-upstream-increase-backlog.patch
  * fix-upstream-timeout-reset-1.patch
  * fix-upstream-timeout-reset-2.patch
- boo#1027201 dbus-daemon not found
- boo#978477 systemd reseting under heavy load
  * fix-upstream-timeout-reset-1.patch
  * fix-upstream-timeout-reset-2.patch
- boo#1027200 don't generate machine-id in %post systemd will do it
  on first boot.
- swap usage of /bin/false to /usr/bin/false
- Use libexecdir=%{_libdir}/dbus-1 rather then /lib/dbus-1

==== evince ====
Subpackages: evince-lang evince-plugin-comicsdocument evince-plugin-djvudocument evince-plugin-dvidocument evince-plugin-pdfdocument evince-plugin-psdocument evince-plugin-tiffdocument evince-plugin-xpsdocument libevdocument3-4 libevview3-3 nautilus-evince typelib-1_0-EvinceDocument-3_0 typelib-1_0-EvinceView-3_0

- Remove Suggests for unzip, unrar, and 7zip; the comics back end
  no longer uses them (bsc#1072120).

==== gnome-terminal ====
Subpackages: gnome-shell-search-provider-gnome-terminal gnome-terminal-lang nautilus-extension-terminal

- Add gnome-terminal-nb-translation.patch: Add updated Norwegian
  bokm�l translation.
- Run spec-cleaner, modernize spec, use autosetup and make_build
  macros.
- Stop handling glib2_gsettings_schema_post(un) and
  desktop_database_post(un) in post(un), we have file-triggers
  taking care of this for us now.
- Stop passing no longer needed suse_update_desktop_file macro.

==== harfbuzz ====
Version update (1.7.1 -> 1.7.2)
Subpackages: harfbuzz-devel libharfbuzz-icu0 libharfbuzz0 libharfbuzz0-32bit

- Update to version 1.7.2:
  + Optimize hb_set_add_range().
  + Misc fixes.
  + New API: hb_coretext_font_create().

==== hfsutils ====

- Override TKLIBS so xhfsutil does not end buildrequiring
  the X system libraries at all.
- Buildrequire tcl-devel too, which is a direct dependency.

==== installation-images-Kubic ====
Version update (14.347 -> 14.349)

- merge gh#openSUSE/installation-images#222
- allow dangling machine-id symlink (bsc#1027200)
- 14.349
- merge gh#openSUSE/installation-images#218
- etc: update module.config to match 4.15
- 14.348

==== kernel-source ====
Version update (4.14.5 -> 4.14.6)
Subpackages: kernel-default kernel-default-devel kernel-devel kernel-docs kernel-macros kernel-syms

- Linux 4.14.6 (bnc#1012628).
- usb: gadget: udc: renesas_usb3: fix number of the pipes
  (bnc#1012628).
- usb: gadget: core: Fix ->udc_set_speed() speed handling
  (bnc#1012628).
- serdev: ttyport: add missing receive_buf sanity checks
  (bnc#1012628).
- serdev: ttyport: fix NULL-deref on hangup (bnc#1012628).
- serdev: ttyport: fix tty locking in close (bnc#1012628).
- usb: f_fs: Force Reserved1=1 in OS_DESC_EXT_COMPAT
  (bnc#1012628).
- can: mcba_usb: fix device disconnect bug (bnc#1012628).
- can: peak/pci: fix potential bug when probe() fails
  (bnc#1012628).
- can: flexcan: fix VF610 state transition issue (bnc#1012628).
- can: ti_hecc: Fix napi poll return value for repoll
  (bnc#1012628).
- can: kvaser_usb: free buf in error paths (bnc#1012628).
- can: kvaser_usb: Fix comparison bug in
  kvaser_usb_read_bulk_callback() (bnc#1012628).
- can: kvaser_usb: ratelimit errors if incomplete messages are
  received (bnc#1012628).
- can: kvaser_usb: cancel urb on -EPIPE and -EPROTO (bnc#1012628).
- can: mcba_usb: cancel urb on -EPROTO (bnc#1012628).
- can: ems_usb: cancel urb on -EPIPE and -EPROTO (bnc#1012628).
- can: esd_usb2: cancel urb on -EPIPE and -EPROTO (bnc#1012628).
- can: usb_8dev: cancel urb on -EPIPE and -EPROTO (bnc#1012628).
- can: peak/pcie_fd: fix potential bug in restarting tx queue
  (bnc#1012628).
- virtio: release virtio index when fail to device_register
  (bnc#1012628).
- iio: stm32: fix adc/trigger link error (bnc#1012628).
- iio: health: max30102: Temperature should be in milli Celsius
  (bnc#1012628).
- iio: adc: cpcap: fix incorrect validation (bnc#1012628).
- iio: adc: meson-saradc: fix the bit_idx of the adc_en clock
  (bnc#1012628).
- iio: adc: meson-saradc: initialize the bandgap correctly on
  older SoCs (bnc#1012628).
- iio: adc: meson-saradc: Meson8 and Meson8b do not have REG11
  and REG13 (bnc#1012628).
- pinctrl: armada-37xx: Fix direction_output() callback behavior
  (bnc#1012628).
- Drivers: hv: vmbus: Fix a rescind issue (bnc#1012628).
- hv: kvp: Avoid reading past allocated blocks from KVP file
  (bnc#1012628).
- firmware: cleanup FIRMWARE_IN_KERNEL message (bnc#1012628).
- firmware: vpd: Destroy vpd sections in remove function
  (bnc#1012628).
- firmware: vpd: Tie firmware kobject to device lifetime
  (bnc#1012628).
- firmware: vpd: Fix platform driver and device
  registration/unregistration (bnc#1012628).
- isa: Prevent NULL dereference in isa_bus driver callbacks
  (bnc#1012628).
- scsi: dma-mapping: always provide dma_get_cache_alignment
  (bnc#1012628).
- scsi: use dma_get_cache_alignment() as minimum DMA alignment
  (bnc#1012628).
- scsi: libsas: align sata_device's rps_resp on a cacheline
  (bnc#1012628).
- efi: Move some sysfs files to be read-only by root
  (bnc#1012628).
- efi/esrt: Use memunmap() instead of kfree() to free the
  remapping (bnc#1012628).
- ASN.1: fix out-of-bounds read when parsing indefinite length
  item (bnc#1012628).
- ASN.1: check for error from ASN1_OP_END__ACT actions
  (bnc#1012628).
- KEYS: add missing permission check for request_key() destination
  (bnc#1012628).
- KEYS: reject NULL restriction string when type is specified
  (bnc#1012628).
- X.509: reject invalid BIT STRING for subjectPublicKey
  (bnc#1012628).
- X.509: fix comparisons of ->pkey_algo (bnc#1012628).
- x86/idt: Load idt early in start_secondary (bnc#1012628).
- x86/PCI: Make broadcom_postcore_init() check acpi_disabled
  (bnc#1012628).
- KVM: x86: fix APIC page invalidation (bnc#1012628).
- btrfs: fix missing error return in btrfs_drop_snapshot
  (bnc#1012628).
- btrfs: handle errors while updating refcounts in
  update_ref_for_cow (bnc#1012628).
- ALSA: hda/realtek - New codec support for ALC257 (bnc#1012628).
- ALSA: pcm: prevent UAF in snd_pcm_info (bnc#1012628).
- ALSA: seq: Remove spurious WARN_ON() at timer check
  (bnc#1012628).
- ALSA: usb-audio: Fix out-of-bound error (bnc#1012628).
- ALSA: usb-audio: Add check return value for usb_string()
  (bnc#1012628).
- iommu/vt-d: Fix scatterlist offset handling (bnc#1012628).
- smp/hotplug: Move step CPUHP_AP_SMPCFD_DYING to the correct
  place (bnc#1012628).
- s390: always save and restore all registers on context switch
  (bnc#1012628).
- s390/mm: fix off-by-one bug in 5-level page table handling
  (bnc#1012628).
- s390: fix compat system call table (bnc#1012628).
- KVM: s390: Fix skey emulation permission check (bnc#1012628).
- Revert "powerpc: Do not call ppc_md.panic in fadump panic
  notifier" (bnc#1012628).
- powerpc/64s: Initialize ISAv3 MMU registers before setting
  partition table (bnc#1012628).
- iwlwifi: mvm: mark MIC stripped MPDUs (bnc#1012628).
- iwlwifi: mvm: don't use transmit queue hang detection when it
  is not possible (bnc#1012628).
- iwlwifi: mvm: flush queue before deleting ROC (bnc#1012628).
- iwlwifi: add new cards for 9260 and 22000 series (bnc#1012628).
- iwlwifi: mvm: fix packet injection (bnc#1012628).
- iwlwifi: mvm: enable RX offloading with TKIP and WEP
  (bnc#1012628).
- brcmfmac: change driver unbind order of the sdio function
  devices (bnc#1012628).
- kdb: Fix handling of kallsyms_symbol_next() return value
  (bnc#1012628).
- md/r5cache: move mddev_lock() out of r5c_journal_mode_set()
  (bnc#1012628).
- drm/exynos: gem: Drop NONCONTIG flag for buffers allocated
  without IOMMU (bnc#1012628).
- drm/i915: Fix vblank timestamp/frame counter jumps on gen2
  (bnc#1012628).
- media: dvb: i2c transfers over usb cannot be done from stack
  (bnc#1012628).
- media: rc: sir_ir: detect presence of port (bnc#1012628).
- media: rc: partial revert of "media: rc: per-protocol repeat
  period" (bnc#1012628).
- arm64: KVM: fix VTTBR_BADDR_MASK BUG_ON off-by-one
  (bnc#1012628).
- arm: KVM: Fix VTTBR_BADDR_MASK BUG_ON off-by-one (bnc#1012628).
- KVM: VMX: remove I/O port 0x80 bypass on Intel hosts
  (bnc#1012628).
- KVM: arm/arm64: Fix broken GICH_ELRSR big endian conversion
  (bnc#1012628).
- KVM: arm/arm64: vgic-irqfd: Fix MSI entry allocation
  (bnc#1012628).
- KVM: arm/arm64: vgic: Preserve the revious read from the
  pending table (bnc#1012628).
- KVM: arm/arm64: vgic-its: Check result of allocation before use
  (bnc#1012628).
- arm64: fpsimd: Prevent registers leaking from dead tasks
  (bnc#1012628).
- arm64: SW PAN: Point saved ttbr0 at the zero page when switching
  to init_mm (bnc#1012628).
- arm64: SW PAN: Update saved ttbr0 value on enter_lazy_tlb
  (bnc#1012628).
- Revert "ARM: dts: imx53: add srtc node" (bnc#1012628).
- bus: arm-cci: Fix use of smp_processor_id() in preemptible
  context (bnc#1012628).
- bus: arm-ccn: Check memory allocation failure (bnc#1012628).
- bus: arm-ccn: Fix use of smp_processor_id() in preemptible
  context (bnc#1012628).
- bus: arm-ccn: fix module unloading Error: Removing state 147
  which has instances left (bnc#1012628).
- IB/core: Avoid unnecessary return value check (bnc#1012628).
- IB/core: Only enforce security for InfiniBand (bnc#1012628).
- crypto: talitos - fix AEAD test failures (bnc#1012628).
- crypto: talitos - fix memory corruption on SEC2 (bnc#1012628).
- crypto: talitos - fix setkey to check key weakness
  (bnc#1012628).
- crypto: talitos - fix AEAD for sha224 on non sha224 capable
  chips (bnc#1012628).
- crypto: talitos - fix use of sg_link_tbl_len (bnc#1012628).
- crypto: talitos - fix ctr-aes-talitos (bnc#1012628).
- ARM: BUG if jumping to usermode address in kernel mode
  (bnc#1012628).
- ARM: avoid faulting on qemu (bnc#1012628).
- irqchip/qcom: Fix u32 comparison with value less than zero
  (bnc#1012628).
- net/smc: use sk_rcvbuf as start for rmb creation (bnc#1012628).
- kbuild: pkg: use --transform option to prefix paths in tar
  (bnc#1012628).
- coccinelle: fix parallel build with CHECK=scripts/coccicheck
  (bnc#1012628).
- powerpc/perf: Fix pmu_count to count only nest imc pmus
  (bnc#1012628).
- apparmor: fix leak of null profile name if profile allocation
  fails (bnc#1012628).
- x86/mpx/selftests: Fix up weird arrays (bnc#1012628).
- mac80211_hwsim: Fix memory leak in hwsim_new_radio_nl()
  (bnc#1012628).
- gre6: use log_ecn_error module parameter in ip6_tnl_rcv()
  (bnc#1012628).
- route: also update fnhe_genid when updating a route cache
  (bnc#1012628).
- route: update fnhe_expires for redirect when the fnhe exists
  (bnc#1012628).
- rsi: fix memory leak on buf and usb_reg_buf (bnc#1012628).
- drivers/rapidio/devices/rio_mport_cdev.c: fix resource leak
  in error handling path in 'rio_dma_transfer()' (bnc#1012628).
- pipe: match pipe_max_size data type with procfs (bnc#1012628).
- lib/genalloc.c: make the avail variable an atomic_long_t
  (bnc#1012628).
- dynamic-debug-howto: fix optional/omitted ending line number
  to be LARGE instead of 0 (bnc#1012628).
- NFS: Fix a typo in nfs_rename() (bnc#1012628).
- sunrpc: Fix rpc_task_begin trace point (bnc#1012628).
- nfp: inherit the max_mtu from the PF netdev (bnc#1012628).
- nfp: fix flower offload metadata flag usage (bnc#1012628).
- xfs: fix forgotten rcu read unlock when skipping inode reclaim
  (bnc#1012628).
- dt-bindings: usb: fix reg-property port-number range
  (bnc#1012628).
- block: wake up all tasks blocked in get_request() (bnc#1012628).
- sparc64/mm: set fields in deferred pages (bnc#1012628).
- zsmalloc: calling zs_map_object() from irq is a bug
  (bnc#1012628).
- slub: fix sysfs duplicate filename creation when slub_debug=O
  (bnc#1012628).
- sctp: do not free asoc when it is already dead in sctp_sendmsg
  (bnc#1012628).
- sctp: use the right sk after waking up from wait_buf sleep
  (bnc#1012628).
- fcntl: don't leak fd reference when fixup_compat_flock fails
  (bnc#1012628).
- geneve: fix fill_info when link down (bnc#1012628).
- bpf: fix lockdep splat (bnc#1012628).
- clk: stm32h7: fix test of clock config (bnc#1012628).
- clk: sunxi-ng: a83t: Fix i2c buses bits (bnc#1012628).
- clk: qcom: common: fix legacy board-clock registration
  (bnc#1012628).
- clk: uniphier: fix DAPLL2 clock rate of Pro5 (bnc#1012628).
- clk: hi3660: fix incorrect uart3 clock freqency (bnc#1012628).
- mailbox: mailbox-test: don't rely on rx_buffer content to
  signal data ready (bnc#1012628).
- kbuild: rpm-pkg: fix jobserver unavailable warning
  (bnc#1012628).
- atm: horizon: Fix irq release error (bnc#1012628).
- jump_label: Invoke jump_label_test() via early_initcall()
  (bnc#1012628).
- tls: Use kzalloc for aead_request allocation (bnc#1012628).
- xfrm: Copy policy family in clone_policy (bnc#1012628).
- f2fs: fix to clear FI_NO_PREALLOC (bnc#1012628).
- bnxt_re: changing the ip address shouldn't affect new
  connections (bnc#1012628).
- IB/mlx4: Increase maximal message size under UD QP
  (bnc#1012628).
- IB/mlx5: Assign send CQ and recv CQ of UMR QP (bnc#1012628).
- afs: Fix total-length calculation for multiple-page send
  (bnc#1012628).
- afs: Connect up the CB.ProbeUuid (bnc#1012628).
- commit 45f120a
- x86/microcode/AMD: Add support for fam17h microcode loading
  (bsc#1068032).
- commit c1a1611
- netfilter: xt_osf: Add missing permission checks (CVE-2017-17450
  bsc#1071695).
- commit a1ac243
- netlink: Add netns check on taps (CVE-2017-17449 bsc#1071694).
- commit 9e5e383
- netfilter: nfnetlink_cthelper: Add missing permission checks
  (CVE-2017-17448 bsc#1071693).
- commit a208c29
- dccp: CVE-2017-8824: use-after-free in DCCP code (CVE-2017-8824
  bsc#1070771).
- commit bd1657a

==== kf5-filesystem ====

- Properly escape some %
- Remove en docs from an existing .lang file in %kf5_find_lang
  to fix conflicts with rpm 4.14's find_lang.sh

==== libqt5-qttranslations ====
Version update (5.9.2 -> 5.9.3)

- Update to 5.9.3
  * New bugfix release
  * For more details, see:
    http://code.qt.io/cgit/qt/qttranslations.git/tree/dist/changes-5.9.3/?h=v5.9.3

==== libqt5-qtvirtualkeyboard ====
Version update (5.9.2 -> 5.9.3)

- Update to 5.9.3
  * New bugfix release
  * For more details, see:
    http://code.qt.io/cgit/qt/qtvirtualkeyboard.git/tree/dist/changes-5.9.3/?h=v5.9.3

==== manufacturer-PPDs ====

- Fix build with RPM 4.14. When grep finds no match, it returns
  with retval=1, which in turn is interpreted by RPM as 'failure'.
  Old RPM versions had a logic error and 'sometimes' did not cancel
  when a command returned 1, this issue is fixed with RPM 4.14 (and
  in turn asks of us to be more specific in some cases what we
  want).

==== perl-Text-CSV_XS ====
Version update (1.32 -> 1.34)

- updated to 1.34
  see /usr/share/doc/packages/perl-Text-CSV_XS/ChangeLog
  1.34	- 2017-11-05, H.Merijn Brand
  * Bad arg for formula (like "craok") will now die with error 1500
  * Row report in formula reporting was off by 1
  * Add a prominent section about BOM handling
  * Make sheet label more portable (csv2xlsx)
  * Allow munge => \%hash
  * Preserve first row in csv (set_column_names => 0)
  1.33	- 2017-10-19, H.Merijn Brand
  * Small additional fix for eol = 
 + BOM
  * Updated doc for example files
  * Add support for formula actions (issue 11)
  - csv2xls and csv2xlsx now warn by default
  * Reset file info on ->header call (RT#123320)

==== pinentry ====
Version update (1.0.0 -> 1.1.0)
Subpackages: pinentry-gnome3 pinentry-gtk2 pinentry-qt5

- pinentry 1.1.0:
  * Add FLTK1.3-based pinentry
  * New option --ttyalert for pinentry-curses to alert the user.
  * Don't show "save passphrase" checkbox if secret service is
    unavailable.
  * The GTK Pinentry shows on Linux some information anout the
    process which invoked the Pinentry.
  * The GTK Pinentry does not anymore show tooltips when keyboard
    grabbing is enabled.

==== postgresql ====
Subpackages: postgresql-contrib postgresql-devel postgresql-docs postgresql-server

- add provides for all the pkgconfig() provides you also find in
  the postgresqlXY-devel packages. then we automatically will pull
  postgresql-devel which in turn will pull our default
  postgresqlXY-devel package. (boo#1071971)
- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)

==== tiff ====
Version update (4.0.8 -> 4.0.9)
Subpackages: libtiff-devel libtiff5 libtiff5-32bit

- Upgrade to upstream release 4.0.9
  * Changes in the software configuration:
    + test/Makefile.am: Add some tests for tiff2bw.
    + .appveyor.yml, .travis.yml, build/travis-ci: apply patches
    0001-ci-Travis-script-improvements.patch and
    0002-ci-Invoke-helper-script-via-shell.patch by Roger Leigh
    + .travis.yml, build/travis-ci: new files from
    0001-ci-Add-Travis-support-for-Linux-builds-with-Autoconf.patch
    by Roger Leigh. This patch adds support for the Travis-CI
    service.
    + .appveyor.yml: new file from
    0002-ci-Add-AppVeyor-support.patch by Roger Leigh (sent to
    mailing list on 2017-06-08) This patch adds a .appveyor.yml
    file to the top-level. This allows one to opt in to having a
    branch built on Windows with Cygwin, MinGW and MSVC
    automatically when a branch is pushed to GitHub, GitLab,
    BitBucket or any other supported git hosting service.
    + CMakeLists.txt, test/CMakeLists.txt,
    test/TiffTestCommon.cmake: apply patch
    0001-cmake-Improve-Cygwin-and-MingGW-test-support.patch from
    Roger Leigh. This patch makes the CMake build system support
    running the tests with MinGW or  Cygwin.
    + test/tiffcp-lzw-compat.sh, test/images/quad-lzw-compat.tiff:
    new files to test old-style LZW decompression
    + test/common.sh, Makefile.am, CMakeList.txt: updated with above
    + test/Makefile.am: add missing reference to
    images/quad-lzw-compat.tiff to fix "make distcheck". Patch by
    Roger Leigh
    + nmake.opt: support a DEBUG=1 option, so as to adjust OPTFLAGS
    and use /MDd runtime in debug mode.
  * Changes in libtiff:
    + libtiff/tif_color.c: TIFFYCbCrToRGBInit(): stricter clamping
    to avoid int32 overflow in TIFFYCbCrtoRGB(). Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1844
    + libtiff/tif_getimage.c: initYCbCrConversion(): stricter
    validation for refBlackWhite coefficients values. To avoid
    invalid float->int32 conversion (when refBlackWhite[0] ==
    2147483648.f) Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1907
    + libtiff/tif_dirinfo.c, tif_dirread.c: add
    _TIFFCheckFieldIsValidForCodec(), and use it in
    TIFFReadDirectory() so as to ignore fields whose tag is a
    codec-specified tag but this codec is not enabled. This avoids
    TIFFGetField() to behave differently depending on whether the
    codec is enabled or not, and thus can avoid stack based buffer
    overflows in a number of TIFF utilities such as tiffsplit,
    tiffcmp, thumbnail, etc. Patch derived from
    0063-Handle-properly-CODEC-specific-tags.patch
    (http://bugzilla.maptools.org/show_bug.cgi?id=2580) by Rapha�l
    Hertzog.
    Fixes: http://bugzilla.maptools.org/show_bug.cgi?id=2580
    http://bugzilla.maptools.org/show_bug.cgi?id=2693
    http://bugzilla.maptools.org/show_bug.cgi?id=2625
    (CVE-2016-10095, bsc#1017690)
    http://bugzilla.maptools.org/show_bug.cgi?id=2564
    (CVE-2015-7554, bsc#960341)
    http://bugzilla.maptools.org/show_bug.cgi?id=2561
    (CVE-2016-5318, bsc#983436)
    http://bugzilla.maptools.org/show_bug.cgi?id=2499
    (CVE-2014-8128, bsc#969783)
    http://bugzilla.maptools.org/show_bug.cgi?id=2441
    http://bugzilla.maptools.org/show_bug.cgi?id=2433
    + libtiff/tif_swab.c: if DISABLE_CHECK_TIFFSWABMACROS is
    defined, do not do the #ifdef TIFFSwabXXX checks. Make it
    easier for GDAL to rename the symbols of its internal libtiff
    copy.
    + libtiff/tif_dirread.c: fix regression of libtiff 4.0.8 in
    ChopUpSingleUncompressedStrip() regarding update of newly
    single-strip uncompressed files whose bytecount is 0. Before
    the change of 2016-12-03, the condition bytecount==0 used to
    trigger an early exit/disabling of strip chop. Re-introduce
    that in update mode. Otherwise this cause later incorrect
    setting for the value of StripByCounts/StripOffsets.
    (https://trac.osgeo.org/gdal/ticket/6924)
    + libtiff/tif_dirread.c: TIFFFetchStripThing(): limit the
    number of items read in StripOffsets/StripByteCounts tags to
    the number of strips to avoid excessive memory allocation.
    Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2215
    + libtiff/tif_getimage.c: avoid many (harmless) unsigned int
    overflows.
    + libtiff/tif_fax3.c: avoid unsigned int overflow in
    Fax3Encode2DRow(). Could potentially be a bug with huge rows.
    + libtiff/tif_jpeg.c: avoid (harmless) unsigned int overflow on
    tiled images.
    + libtiff/tif_dirread.c: avoid unsigned int overflow in
    EstimateStripByteCounts() and BYTECOUNTLOOKSBAD when file is
    too short.
    + libtiff/tif_predict.c: decorate legitimate functions where
    unsigned int overflow occur with
    TIFF_NOSANITIZE_UNSIGNED_INT_OVERFLOW
    + libtiff/tif_dirread.c: avoid unsigned int overflow in
    EstimateStripByteCounts()
    + libtiff/tiffiop.h: add TIFF_NOSANITIZE_UNSIGNED_INT_OVERFLOW
    macro to disable CLang warnings raised by
  - fsanitize=undefined,unsigned-integer-overflow
    + libtiff/tif_jpeg.c: add anti-denial of service measure to
    avoid excessive CPU consumption on progressive JPEGs with a
    huge number of scans. See
    http://www.libjpeg-turbo.org/pmwiki/uploads/About/TwoIssueswiththeJPEGStandard.pdf
    Note: only affects libtiff since 2014-12-29 where support of
    non-baseline JPEG was added.
    + libtiff/tif_jpeg.c: error out at decoding time if anticipated
    libjpeg memory allocation is above 100 MB. libjpeg in case of
    multiple scans, which is allowed even in baseline JPEG, if
    components are spread over several scans and not
    interleavedin a single one, needs to allocate memory (or
    backing store) for the whole strip/tile. See
    http://www.libjpeg-turbo.org/pmwiki/uploads/About/TwoIssueswiththeJPEGStandard.pdf
    This limitation may be overriden by setting the
    LIBTIFF_ALLOW_LARGE_LIBJPEG_MEM_ALLOC environment variable, or
    recompiling libtiff with a custom value of
    TIFF_LIBJPEG_LARGEST_MEM_ALLOC macro.
    + libtiff/tif_jbig.c: fix memory leak in error code path of
    JBIGDecode()
    Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2706
    (CVE-2017-9936, bsc#1046073)
    + libtiff/tif_dirread.c: in TIFFReadDirEntryFloat(), check that
    a double value can fit in a float before casting.
    + libtiff/tiffiop.h, libtiff/tif_jpeg.c, libtiff/tif_jpeg_12.c,
    libtiff/tif_read.c: make TIFFReadScanline() works in
    CHUNKY_STRIP_READ_SUPPORT mode with JPEG stream with multiple
    scans. Also make configurable through a
    LIBTIFF_JPEG_MAX_ALLOWED_SCAN_NUMBER environment variable the
    maximum number of scans allowed. Defaults to 100.
    + libtiff/tif_read.c: TIFFFillTile(): add limitation to the
    number of bytes read in case td_stripbytecount[strip] is
    bigger than reasonable, so as to avoid excessive memory
    allocation (similarly to what was done for TIFFFileStrip() on
    2017-05-10)
    + libtiff/tif_getimage.c: use
    _TIFFReadEncodedStripAndAllocBuffer(). Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2708 and
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2433
    + libtiff/tif_read.c, tiffiop.h: add a
    _TIFFReadEncodedStripAndAllocBuffer() function, variant of
    TIFFReadEncodedStrip() that allocates the decoded buffer only
    after a first successful TIFFFillStrip(). This avoids
    excessive memory allocation on corrupted files.
    + libtiff/tif_dirwrite.c: in TIFFWriteDirectoryTagCheckedXXXX()
    functions associated with LONG8/SLONG8 data type, replace
    assertion that the file is BigTIFF, by a non-fatal error.
    Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2712
    + libtiff/tif_read.c: TIFFStartTile(): set tif_rawcc to
    tif_rawdataloaded when it is set. Similarly to
    TIFFStartStrip(). This issue was revealed by the change of
    2017-06-30 in TIFFFileTile(), limiting the number of bytes
    read. But it could probably have been hit too in
    CHUNKY_STRIP_READ_SUPPORT mode previously. Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2454
    + libtiff/tif_error.c, tif_warning.c: correctly use va_list
    when both an old-style and new-style warning/error handlers
    are installed. Patch by Paavo Helde (sent on the mailing list)
    + libtiff/tif_getimage.c: use _TIFFReadTileAndAllocBuffer().
    Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2470
    + libtiff/tif_read.c, tiffiop.h: add a
    _TIFFReadEncodedTileAndAllocBuffer() and
    _TIFFReadTileAndAllocBuffer() variants of
    TIFFReadEncodedTile() and TIFFReadTile() that allocates the
    decoded buffer only after a first successful TIFFFillTile().
    This avoids excessive memory allocation on corrupted files.
    + libtiff/tif_pixarlog.c: avoid excessive memory allocation on
    decoding when RowsPerStrip tag is not defined (and thus
    td_rowsperstrip == UINT_MAX) Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2554
    + libtiff/tif_lzw.c: fix 4.0.8 regression in the decoding of
    old-style LZW compressed files.
    + libtiff/tif_lzw.c: fix potential out-of-buffer read on 1-byte
    LZW strips. Crashing issue only on memory mapped files, where
    the strip offset is the last byte of the file, and the file
    size is a multiple of one page size on the CPU architecture
    (typically 4096)
    + libtiff/tif_dir.c: avoid potential null pointer dereference
    in _TIFFVGetField() on corrupted TIFFTAG_NUMBEROFINKS tag
    instance.
    Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2713
    + tools/tiff2pdf.c: prevent heap buffer overflow write in "Raw"
    mode on PlanarConfig=Contig input images. Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2715
    + libtiff/tif_read.c: TIFFFillStrip() / TIFFFillTile().
    Complementary fix for
    http://bugzilla.maptools.org/show_bug.cgi?id=2708 in the
    isMapped() case, so as to avoid excessive memory allocation
    when we need a temporary buffer but the file is truncated.
    + libtiff/tif_read.c: in TIFFFetchStripThing(), only grow the
    arrays that hold StripOffsets/StripByteCounts, when they are
    smaller than the expected number of striles, up to 1 million
    striles, and error out beyond. Can be tweaked by setting the
    environment variable LIBTIFF_STRILE_ARRAY_MAX_RESIZE_COUNT.
    This partially goes against a change added on 2002-12-17 to
    accept those arrays of wrong sizes, but is needed to avoid
    denial of services. Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2350
    + libtiff/tif_read.c: add protection against excessive memory
    allocation attempts in TIFFReadDirEntryArray() on short files.
    Effective for mmap'ed case. And non-mmap'ed case, but
    restricted to 64bit builds. Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2675
    + libtiff/tif_luv.c: LogLuvInitState(): avoid excessive memory
    allocation when RowsPerStrip tag is missing. Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2683
    + libtiff/tif_getimage.c: gtTileContig() and gtTileSeparate():
    properly break from loops on error when stoponerr is set,
    instead of going on iterating on row based loop.
    + libtiff/tif_getimage.c: fix fromskew computation when
    to-be-skipped pixel number is not a multiple of the horizontal
    subsampling, and also in some other cases. Impact
    putcontig8bitYCbCr44tile, putcontig8bitYCbCr42tile,
    putcontig8bitYCbCr41tile, putcontig8bitYCbCr21tile and
    putcontig8bitYCbCr12tile Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2637 and
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2691
    + libtiff/tif_luv.c: further reduce memory requirements for
    temporary buffer when RowsPerStrip >= image_length in
    LogLuvInitState() and LogL16InitState(). Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2700
    + libtiff/tif_dirwrite.c: replace assertion related to not
    finding the SubIFD tag by runtime check (in
    TIFFWriteDirectorySec()) Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2727
    + libtiff/tif_dirwrite.c: replace assertion to tag value not
    fitting on uint32 when selecting the value of SubIFD tag by
    runtime check (in TIFFWriteDirectoryTagSubifd()). Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2728
    + libtiff/tif_jpeg.c: accept reading the last strip of a JPEG
    compressed file if the codestream height is larger than the
    truncated height of the strip. Emit a warning in this
    situation since this is non compliant.
    + libtiff/tiffiop.h, tif_aux.c: redirect SeekOK() macro to a
    _TIFFSeekoK() function that checks if the offset is not
    bigger than INT64_MAX, so as to avoid a -1 error return code
    of TIFFSeekFile() to match a required seek to UINT64_MAX/-1.
    Fixes http://bugzilla.maptools.org/show_bug.cgi?id=2726
    + libtiff/tif_dirread.c: add NULL check to avoid likely false
    positive null-pointer dereference warning by CLang Static
    Analyzer.
    + libtiff/libtiff.def: add TIFFReadRGBAStripExt and
    TIFFReadRGBATileExt Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2735
    + libtiff/tif_jpeg.c: add compatibility with libjpeg-turbo
    1.5.2 that honours max_memory_to_use > 0. Cf
    https://github.com/libjpeg-turbo/libjpeg-turbo/issues/162
    + libtiff/tif_getimage.c: avoid floating point division by zero
    in initCIELabConversion() Fixes
    https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=3733
  * Changes in the tools:
    + tools/tiff2pdf.c: prevent heap buffer overflow write in "Raw"
    mode on PlanarConfig=Contig input images. Fixes
    http://bugzilla.maptools.org/show_bug.cgi?id=2715
    + tools/tiffset.c: fix setting a single value for the
    ExtraSamples tag (and other tags with variable number of
    values). So 'tiffset -s ExtraSamples 1 X'. This only worked
    when setting 2 or more values, but not just one.
    + tools/fax2tiff.c (_FAX_Client_Data): Pass FAX_Client_Data as
    the client data. This client data is not used at all at the
    moment, but it makes the most sense. Issue that the value of
    client_data.fd was passed where a pointer is expected.
    + tools/tiff2pdf.c (t2p_sample_realize_palette): Fix possible
    arithmetic overflow in bounds checking code and eliminate
    comparison between signed and unsigned type.
    + tools/tiff2bw.c (main): Free memory allocated in the tiff2bw
    program. This is in response to the report associated with
    CVE-2017-16232, bsc#1069213 but does not solve the extremely
    high memory usage with the associated POC file.

==== tigervnc ====

- Depend on pkgconfig's gl, egl and gbm instead of Mesa-devel.
  * Those dependencies are what the underlying X server really
    needs. Mesa-devel is too general and is a bottleneck in
    distribution build. (bnc#1071297)

==== vte ====
Subpackages: libvte-2_91-0 typelib-1_0-Vte-2.91 vte-lang

- Add vte-fix-memory-leaks.patch: Fix memory leaks (bgo#790539).
- Add
  vte-widget-reset-might-need-to-start-blinking-the-cursor.patch:
  widget: Reset might need to start blinking the cursor
  (bgo#790536).
- Drop gnome-pty-helper Obsoletes: Not present in any currently
  supported opensuse release.
- Modernize spec, run spec-cleaner, switch to to autosetup,
  make_build and make_install macros.
- No longer export fPIE/pie SUID_CFLAGS/SUID_LDFLAGS, not needed
  anymore.

==== xf86-video-ati ====

- Remove build dependency on Mesa-devel, it is not needed. Add
  build dependency on damageproto-devel which is needed and was
  pulled in by Mesa-devel before.

==== xorg-x11-server ====
Subpackages: xorg-x11-server-sdk

- Depend on pkgconfig's gl, egl and gbm instead of Mesa-devel.
  * Those dependencies are what xorg-x11-server really needs.
    Mesa-devel is too general and is a bottleneck in distribution
    build. (bnc#1071297)