SUSE-IU-2026:6899-1: Security update of suse/sl-micro/6.0/base-os-container

[sle-container-updates at lists.suse.com]

SUSE Image Update Advisory: suse/sl-micro/6.0/base-os-container
-----------------------------------------------------------------
Image Advisory ID : SUSE-IU-2026:6899-1
Image Tags        : suse/sl-micro/6.0/base-os-container:2.1.3 , suse/sl-micro/6.0/base-os-container:2.1.3-7.209 , suse/sl-micro/6.0/base-os-container:latest
Image Release     : 7.209
Severity          : critical
Type              : security
References        : 1257249 1271730 1272534 1273242 1274091 1274625 1277790 
-----------------------------------------------------------------

The container suse/sl-micro/6.0/base-os-container was updated. The following patches have been included in this update:

-----------------------------------------------------------------
Advisory ID: 890
Released:    Wed Sep  9 16:10:30 2026
Summary:     Security update for libzypp, zypper
Type:        security
Severity:    critical
References:  1257249,1271730,1272534,1273242,1274091,1274625,1277790
This update for libzypp, zypper fixes the following issues:

Security issue fixed:

- invalidating legacy libzypp unsigned-repository cache state [LIBZYPP-LEGACY-CACHE-01] (bsc#1274625).
- hasCredentials() requires both username AND password to be non-empty (bsc#1273242).
- GPG Key hints in repoindex.xml require at least a long id to allow auto-import (bsc#1271730).

Non security issues fixed:

- Econf parser adds tags in drop-in files outside any section to [main] (bsc#1272534).
- Need zypper option to disable services to fix Dockerfile builds in OBS (bsc#1257249).
- zypper loads repository data and installed packages prior to checking for required arguments (bsc#1274091).
- Zypper patch doesn't give enough details about conflicts (bsc#1277790).

Changes for libzypp:

- Update to version 17.38.15:

  - Prevent libgpgme from launching gpg-agents; we don't need them.
  - defaultLoadSystem: Hand out the ZYpp::Ptr as return value.
  - Replace popen cat/zcat with solv_xfopen for testcase loaders
    (fixes #749)
  - zypp: Improve Testcase Loading for MCP Tools.
  - spec: Remove useless %bcond visibility_hidden (is always ON in
    cmake)

Changes for zypper:

- Update to version 1.14.101.


The following package changes have been done:

- libzypp-17.38.15-1.1 updated
- zypper-1.14.101-1.1 updated
- container:suse-toolbox-image-1.0.0-9.164 updated