Packages changed:
  baloo5
  discover
  drkonqi5
  filesystem
  gcc11
  gnome-tweaks (40.0 -> 40.10)
  grub2
  gtk3 (3.24.32 -> 3.24.33)
  hwdata (0.356 -> 0.357)
  jack (1.9.19 -> 1.9.20)
  kactivitymanagerd
  kauth
  kde-gtk-config5
  kdelibs4support
  kscreenlocker
  kwalletmanager5
  kwayland
  kwin5
  libksysguard5
  libnvme
  libxklavier (5.3 -> 5.4)
  ncurses (6.3.20220219 -> 6.3.20220226)
  openssh (8.8p1 -> 8.9p1)
  plasma5-desktop
  plasma5-workspace
  polkit-kde-agent-5
  powerdevil5
  raspberrypi-firmware
  raspberrypi-firmware-config
  sudo
  systemd
  tracker-miners (3.2.1 -> 3.2.2)
  upower (0.99.16 -> 0.99.16+4)
  wireless-regdb (20220108 -> 20220218)
  xdg-desktop-portal
  xdg-desktop-portal-kde

=== Details ===

==== baloo5 ====
Subpackages: baloo5-imports baloo5-kioslaves libKF5Baloo5 libKF5BalooEngine5

- Replace %_libdir/libexec with %_libexecdir (boo#1174075)

==== discover ====
Subpackages: discover-backend-flatpak discover-backend-packagekit discover-notifier

- Replace %_libdir/libexec with %_libexecdir (boo#1174075)

==== drkonqi5 ====

- Replace %_libdir/libexec with %_libexecdir (boo#1174075)

==== filesystem ====

- Create tmpfiles.d which creates /usr/local on the fly

==== gcc11 ====
Subpackages: cpp11 libgcc_s1 libgomp1 libstdc++6 libubsan1

- Add a list of Obsoletes to libstdc++6-pp-gcc11 so updates from
  packages provided by older GCC work.  Add a requires from that
  package to the corresponding libstc++6 package to keep those
  at the same version.  [bsc#1196107]

==== gnome-tweaks ====
Version update (40.0 -> 40.10)

- Update to version 40.10:
  + Fix for the broken GNOME Extensions link.
  + Fix build with meson 0.60 and newer.
  + Updated translations.
- Drop 86.patch: Fixed upstream.

==== grub2 ====
Subpackages: grub2-arm64-efi grub2-snapper-plugin

- Support saving grub environment for POWER signed grub images (jsc#SLE-23854)
  * 0001-Add-grub_envblk_buf-helper-function.patch
  * 0002-Add-grub_disk_write_tail-helper-function.patch
  * 0003-grub-install-support-prep-environment-block.patch
  * 0004-Introduce-prep_load_env-command.patch
  * 0005-export-environment-at-start-up.patch
- Use enviroment variable in early boot config to looking up root device
  * grub2.spec
- Remove obsolete openSUSE 12.2 conditionals in spec file
- Clean up powerpc certificate handling.

==== gtk3 ====
Version update (3.24.32 -> 3.24.33)
Subpackages: gtk3-data gtk3-schema gtk3-tools libgtk-3-0 typelib-1_0-Gtk-3_0

- Update to version 3.24.33:
  + No changes.

==== hwdata ====
Version update (0.356 -> 0.357)

- Update to version 0.357:
  + Updated pci, usb and vendor ids.

==== jack ====
Version update (1.9.19 -> 1.9.20)

- Disable the build of example-tools which are now built in a
  separate jack-example-tools package.
- update to 1.9.20:
  * Add waf autooption --example-tools to allow optional build of
    executables, libraries and man pages provided by
    jack-example-tools (the files are built by default). Building
    and installing the additional files can be disabled by using
  - -example-tools=no or --no-example-tools.
  * Fix 32-bit support in ALSA driver
  * Fix incomplete ASIO support on Windows
  * Fix metadata usage with multiple users
  * Fix netsource tool missing on Windows
  * Fix semaphore usage on macOS
  * Official FreeBSD support

==== kactivitymanagerd ====

- Replace %_libdir/libexec with %_libexecdir (boo#1174075)

==== kauth ====
Subpackages: libKF5Auth5 libKF5AuthCore5

- Replace %_libdir/libexec with %_libexecdir (boo#1174075)

==== kde-gtk-config5 ====
Subpackages: kde-gtk-config5-gtk3

- Replace %_libdir/libexec with %_libexecdir (boo#1174075)

==== kdelibs4support ====
Subpackages: libKF5KDELibs4Support5

- Add patch to fix installation:
  * 0001-Use-KDE_INSTALL_FULL_-variables-where-needed.patch

==== kscreenlocker ====
Subpackages: libKScreenLocker5

- Replace %_libdir/libexec with %_libexecdir (boo#1174075)

==== kwalletmanager5 ====

- Replace %_libdir/libexec with %_libexecdir (boo#1174075)

==== kwayland ====

- Replace %_libdir/libexec with %_libexecdir (boo#1174075)

==== kwin5 ====

- Replace %_libdir/libexec with %_libexecdir (boo#1174075)

==== libksysguard5 ====
Subpackages: ksysguardsystemstats-data libKSysGuardSystemStats1 libksysguard5-imports

- Replace %_libdir/libexec with %_libexecdir (boo#1174075)

==== libnvme ====

- Update License information. The library is released under
  LGPL-2.1-or-later and not LGPL-2.1-only.

==== libxklavier ====
Version update (5.3 -> 5.4)

- Update to version 5.4:
  + A couple of introspection fixes.
- Update URL, this version was never released on download.gnome.org
- Add explicit libxklavier16 (shared library) Requires in devel
  sub-package (we already pulled it in via virtual provides).
- Use modern macros.

==== ncurses ====
Version update (6.3.20220219 -> 6.3.20220226)
Subpackages: libncurses6 ncurses-utils terminfo-base

- Add ncurses patch 20220226
  + fix issues found with coverity:
    + rewrite canonical_name() function of infocmp to ensure buffer size
    + corrected use of original tty-modes in tput init/reset subcommands
    + modify tabs program to limit tab-stop values to max-columns
    + add limit-checks for palette rgb values in test/ncurses.c
  + add a few null-pointer checks to help with static-analysis.
  + enforce limit on number of soft-keys used in c++ binding.
  + adjust a buffer-limit in write_entry.c to quiet a bogus warning from
    gcc 12.0.1

==== openssh ====
Version update (8.8p1 -> 8.9p1)
Subpackages: openssh-clients openssh-common openssh-server

- Version update to 8.9p1:
  = Security
  * sshd(8): fix an integer overflow in the user authentication path
    that, in conjunction with other logic errors, could have yielded
    unauthenticated access under difficult to exploit conditions.
    This situation is not exploitable because of independent checks in
    the privilege separation monitor. Privilege separation has been
    enabled by default in since openssh-3.2.2 (released in 2002) and
    has been mandatory since openssh-7.5 (released in 2017). Moreover,
    portable OpenSSH has used toolchain features available in most
    modern compilers to abort on signed integer overflow since
    openssh-6.5 (released in 2014).
    Thanks to Malcolm Stagg for finding and reporting this bug.
  = Potentially-incompatible changes
  * sshd(8), portable OpenSSH only: this release removes in-built
    support for MD5-hashed passwords. If you require these on your
    system then we recommend linking against libxcrypt or similar.
  * This release modifies the FIDO security key middleware interface
    and increments SSH_SK_VERSION_MAJOR.
  = New features
  * ssh(1), sshd(8), ssh-add(1), ssh-agent(1): add a system for
    restricting forwarding and use of keys added to ssh-agent(1)
    A detailed description of the feature is available at
    https://www.openssh.com/agent-restrict.html and the protocol
    extensions are documented in the PROTOCOL and PROTOCOL.agent
    files in the source release.
  * ssh(1), sshd(8): add the sntrup761x25519-sha512@openssh.com hybrid
    ECDH/x25519 + Streamlined NTRU Prime post-quantum KEX to the
    default KEXAlgorithms list (after the ECDH methods but before the
    prime-group DH ones). The next release of OpenSSH is likely to
    make this key exchange the default method.
  * ssh-keygen(1): when downloading resident keys from a FIDO token,
    pass back the user ID that was used when the key was created and
    append it to the filename the key is written to (if it is not the
    default). Avoids keys being clobbered if the user created multiple
    resident keys with the same application string but different user
    IDs.
  * ssh-keygen(1), ssh(1), ssh-agent(1): better handling for FIDO keys
    on tokens that provide user verification (UV) on the device itself,
    including biometric keys, avoiding unnecessary PIN prompts.
  * ssh-keygen(1): add "ssh-keygen -Y match-principals" operation to
    perform matching of principals names against an allowed signers
    file. To be used towards a TOFU model for SSH signatures in git.
  * ssh-add(1), ssh-agent(1): allow pin-required FIDO keys to be added
    to ssh-agent(1). $SSH_ASKPASS will be used to request the PIN at
    authentication time.
  * ssh-keygen(1): allow selection of hash at sshsig signing time
    (either sha512 (default) or sha256).
  * ssh(1), sshd(8): read network data directly to the packet input
    buffer instead of indirectly via a small stack buffer. Provides a
    modest performance improvement.
  * ssh(1), sshd(8): read data directly to the channel input buffer,
    providing a similar modest performance improvement.
  * ssh(1): extend the PubkeyAuthentication configuration directive to
    accept yes|no|unbound|host-bound to allow control over one of the
    protocol extensions used to implement agent-restricted keys.
  = Bugfixes
  * sshd(8): document that CASignatureAlgorithms, ExposeAuthInfo and
    PubkeyAuthOptions can be used in a Match block. PR277.
  * sshd(8): fix possible string truncation when constructing paths to
    .rhosts/.shosts files with very long user home directory names.
  * ssh-keysign(1): unbreak for KEX algorithms that use SHA384/512
    exchange hashes
  * ssh(1): don't put the TTY into raw mode when SessionType=none,
    avoids ^C being unable to kill such a session. bz3360
  * scp(1): fix some corner-case bugs in SFTP-mode handling of
    ~-prefixed paths.
  * ssh(1): unbreak hostbased auth using RSA keys. Allow ssh(1) to
    select RSA keys when only RSA/SHA2 signature algorithms are
    configured (this is the default case). Previously RSA keys were
    not being considered in the default case.
  * ssh-keysign(1): make ssh-keysign use the requested signature
    algorithm and not the default for the key type. Part of unbreaking
    hostbased auth for RSA/SHA2 keys.
  * ssh(1): stricter UpdateHostkey signature verification logic on
    the client- side. Require RSA/SHA2 signatures for RSA hostkeys
    except when RSA/SHA1 was explicitly negotiated during initial
    KEX; bz3375
  * ssh(1), sshd(8): fix signature algorithm selection logic for
    UpdateHostkeys on the server side. The previous code tried to
    prefer RSA/SHA2 for hostkey proofs of RSA keys, but missed some
    cases. This will use RSA/SHA2 signatures for RSA keys if the
    client proposed these algorithms in initial KEX. bz3375
  * All: convert all uses of select(2)/pselect(2) to poll(2)/ppoll(2).
    This includes the mainloops in ssh(1), ssh-agent(1), ssh-agent(1)
    and sftp-server(8), as well as the sshd(8) listen loop and all
    other FD read/writability checks. On platforms with missing or
    broken poll(2)/ppoll(2) syscalls a select(2)-based compat shim is
    available.
  * ssh-keygen(1): the "-Y find-principals" command was verifying key
    validity when using ca certs but not with simple key lifetimes
    within the allowed signers file.
  * ssh-keygen(1): make sshsig verify-time argument parsing optional
  * sshd(8): fix truncation in rhosts/shosts path construction.
  * ssh(1), ssh-agent(1): avoid xmalloc(0) for PKCS#11 keyid for ECDSA
    keys (we already did this for RSA keys). Avoids fatal errors for
    PKCS#11 libraries that return empty keyid, e.g. Microchip ATECC608B
    "cryptoauthlib"; bz#3364
  * ssh(1), ssh-agent(1): improve the testing of credentials against
    inserted FIDO: ask the token whether a particular key belongs to
    it in cases where the token supports on-token user-verification
    (e.g. biometrics) rather than just assuming that it will accept it.
    Will reduce spurious "Confirm user presence" notifications for key
    handles that relate to FIDO keys that are not currently inserted in at
    least some cases. bz3366
  * ssh(1), sshd(8): correct value for IPTOS_DSCP_LE. It needs to
    allow for the preceding two ECN bits. bz#3373
  * ssh-keygen(1): add missing -O option to usage() for the "-Y sign"
    option.
  * ssh-keygen(1): fix a NULL deref when using the find-principals
    function, when matching an allowed_signers line that contains a
    namespace restriction, but no restriction specified on the
    command-line
  * ssh-agent(1): fix memleak in process_extension(); oss-fuzz
    issue #42719
  * ssh(1): suppress "Connection to xxx closed" messages when LogLevel
    is set to "error" or above. bz3378
  * ssh(1), sshd(8): use correct zlib flags when inflate(3)-ing
    compressed packet data. bz3372
  * scp(1): when recursively transferring files in SFTP mode, create the
    destination directory if it doesn't already exist to match scp(1) in
    legacy RCP mode behaviour.
  * scp(1): many improvements in error message consistency between scp(1)
    in SFTP mode vs legacy RCP mode.
  * sshd(8): fix potential race in SIGTERM handling PR289
  * ssh(1), ssh(8): since DSA keys are deprecated, move them to the
    end of the default list of public keys so that they will be tried
    last. PR295
  * ssh-keygen(1): allow 'ssh-keygen -Y find-principals' to match
    wildcard principals in allowed_signers files
  = Portability
  * ssh(1), sshd(8): don't trust closefrom(2) on Linux. glibc's
    implementation does not work in a chroot when the kernel does not
    have close_range(2). It tries to read from /proc/self/fd and when
    that fails dies with an assertion of sorts. Instead, call
    close_range(2) directly from our compat code and fall back if
    that fails.  bz#3349,
  * OS X poll(2) is broken; use compat replacement. For character-
    special devices like /dev/null, Darwin's poll(2) returns POLLNVAL
    when polled with POLLIN. Apparently this is Apple bug 3710161 -
    not public but a websearch will find other OSS projects
    rediscovering it periodically since it was first identified in
    2005.
  * Correct handling of exceptfds/POLLPRI in our select(2)-based
    poll(2)/ppoll(2) compat implementation.
  * Cygwin: correct checking of mbstowcs() return value.
  * Add a basic SECURITY.md that refers people to the openssh.com
    website.
  * Enable additional compiler warnings and toolchain hardening flags,
    including -Wbitwise-instead-of-logical, -Wmisleading-indentation,
  - fzero-call-used-regs and -ftrivial-auto-var-init.
  * HP/UX. Use compat getline(3) on HP-UX 10.x, where the libc version
    is not reliable.
- Rebased patches:
  * openssh-7.7p1-ldap.patch
  * openssh-8.0p1-gssapi-keyex.patch
  * openssh-8.1p1-audit.patch
  * openssh-8.4p1-vendordir.patch
  * openssh-reenable-dh-group14-sha1-default.patch

==== plasma5-desktop ====

- Replace %_libdir/libexec with %_libexecdir (boo#1174075)

==== plasma5-workspace ====
Subpackages: gmenudbusmenuproxy plasma5-session plasma5-session-wayland plasma5-workspace-libs xembedsniproxy

- Replace %_libdir/libexec with %_libexecdir (boo#1174075)

==== polkit-kde-agent-5 ====

- Replace %_libdir/libexec with %_libexecdir (boo#1174075)

==== powerdevil5 ====

- Replace %_libdir/libexec with %_libexecdir (boo#1174075)

==== raspberrypi-firmware ====

- Install modprobe.conf files to %_modprobedir (bsc#1196275, jsc#SLE-20639)

==== raspberrypi-firmware-config ====

- Install modprobe.conf files to %_modprobedir (bsc#1196275, jsc#SLE-20639)

==== sudo ====

- Add sudo-1.9.9-honor-T_opt.patch
  * the -T option of sudo does nothing even when
  'Defaults user_command_timeouts' is present in the configuration.
  * [bsc#1193446]
  * Credit to Jaroslav Jindrak <dzejrou@gmail.com>

==== systemd ====
Subpackages: libsystemd0 libudev1 udev

- Fix the default target when it's been incorrectly set to one of the runlevel
  targets (bsc#1196567)
  The script 'upgrade-from-pre-210.sh' used to initialize the default target
  during migration from sysvinit to systemd. However it created symlinks to
  runlevel targets, which are deprecated and might be missing when
  systemd-sysvcompat package is not installed. If such symlinks are found the
  script now renames them to point to 'true' systemd target units.
- When migrating from sysvinit to systemd (it probably won't happen anymore),
  let's use the default systemd target, which is the graphical.target one. In
  most cases it will do the right thing anyway.

==== tracker-miners ====
Version update (3.2.1 -> 3.2.2)
Subpackages: tracker-miner-files

- Update to version 3.2.2:
  + Backport seccomp rules for rseq and mbind syscalls.
  + Updated translations.
- Drop patches fixed upstream:
  + tracker-miners-allow-mbind.patch
  + tracker-miners-allow-rseq.patch

==== upower ====
Version update (0.99.16 -> 0.99.16+4)
Subpackages: libupower-glib3 typelib-1_0-UpowerGlib-1_0

- Update to version 0.99.16+4:
  + meson.build: Output correct paths for sbindir and datadir.
  + daemon: Initialize FD to -1 to avoid incorrect close.
  + input: Fix FD handling and let input stream close it.
  + linux: Set FD to -1 rather than 0 when closing delay inhibitor.

==== wireless-regdb ====
Version update (20220108 -> 20220218)

- Update to version 20220218:
  * wireless-regdb: update regulatory database based on preceding changes
  * wireless-regdb: Update regulatory rules for the Netherlands (NL) on 6GHz
  * wireless-regdb: Update regulatory rules for China (CN)
  * wireless-regdb: Update regulatory rules for South Korea (KR)
  * Revert "wireless-regdb: Update regulatory rules for South Korea (KR)"
  * wireless-regdb: Update regulatory rules for Spain (ES) on 6GHz
  * wireless-regdb: add 802.11ah bands to world regulatory domain
  * wireless-regdb: add support for US S1G channels
  * wireless-regdb: Update regulatory rules for France (FR) on 6 and 60 GHz
  * wireless-regdb: Update regulatory rules for South Korea (KR)

==== xdg-desktop-portal ====

- Pass --docdir=%%{_defaultdocdir}/%%{name}/ to configure, install
  docs in standard distro docs dir, and move to devel sub-package,
  as it is developer documentation.

==== xdg-desktop-portal-kde ====

- Replace %_libdir/libexec with %_libexecdir (boo#1174075)