• a/kernel-firmware-20180518_2a9b2cf-noarch-1.txz
• a/kernel-generic-4.14.43-x86_64-1.txz
• a/kernel-huge-4.14.43-x86_64-1.txz
• a/kernel-modules-4.14.43-x86_64-1.txz
• a/procps-ng-3.3.15-x86_64-1.txz
  Shared library .so-version bump.
  This update fixes bugs and security issues:
  library: Fix integer overflow and LPE in file2strvec
  library: Use size_t for alloc functions
  pgrep: Fix stack-based buffer overflow
  ps: Fix buffer overflow in output buffer, causing DOS
  top: Don't use cwd for location of config
  For more information, see:
  https://www.qualys.com/2018/05/17/procps-ng-audit-report-advisory.txt
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1124
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1126
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1125
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1123
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1122
  (* Security fix *)
• ap/mariadb-10.2.15-x86_64-1.txz
  This update fixes bugs and security issues.
  For more information, see:
  https://mariadb.com/kb/en/mariadb-10215-release-notes/
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2786
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2759
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2777
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2810
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2782
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2784
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2787
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2766
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2755
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2819
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2817
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2761
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2781
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2771
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2813
  (* Security fix *)
• ap/vim-8.1.0016-x86_64-1.txz
• d/Cython-0.28.2-x86_64-1.txz
• d/cmake-3.11.2-x86_64-1.txz
• d/kernel-headers-4.14.43-x86-1.txz
• d/meson-0.46.1-x86_64-1.txz
• k/kernel-source-4.14.43-noarch-1.txz
  Changes to .config (thanks to tumble):
  TCP_CONG_ADVANCED n → y
  +DEFAULT_CUBIC y
  +DEFAULT_RENO n
  +TCP_CONG_BBR m
  +TCP_CONG_BIC m
  +TCP_CONG_CDG m
  +TCP_CONG_DCTCP m
  +TCP_CONG_HSTCP m
  +TCP_CONG_HTCP m
  +TCP_CONG_HYBLA m
  +TCP_CONG_ILLINOIS m
  +TCP_CONG_LP m
  +TCP_CONG_NV m
  +TCP_CONG_SCALABLE m
  +TCP_CONG_VEGAS m
  +TCP_CONG_VENO m
  +TCP_CONG_WESTWOOD m
  +TCP_CONG_YEAH m
• l/QScintilla-2.10.4-x86_64-1.txz
• l/babl-0.1.50-x86_64-1.txz
• l/glib-networking-2.56.1-x86_64-1.txz
• l/poppler-0.65.0-x86_64-1.txz
  Shared library .so-version bump.
• l/vte-0.52.2-x86_64-1.txz
• n/mutt-1.10.0-x86_64-1.txz
• n/postfix-3.3.1-x86_64-1.txz
• n/stunnel-5.45-x86_64-1.txz
• xap/gimp-2.10.2-x86_64-1.txz
• xap/mozilla-thunderbird-52.8.0-x86_64-1.txz
  This release contains security fixes and improvements.
  For more information, see:
  https://www.mozilla.org/en-US/thunderbird/52.8.0/releasenotes/
  https://www.mozilla.org/en-US/security/advisories/mfsa2018-13/
  (* Security fix *)
• xap/vim-gvim-8.1.0016-x86_64-1.txz
• kernels/*

• a/pkgtools-15.0-noarch-11.txz
  installpkg: Implement locking to prevent screen output or install script
  collisions if multiple copies of installpkg are running simultaneously.
  installpkg: Use $(mcookie) instead of $$. Fall back on $$ if mcookie is
  not available.
  makepkg: Add –compress option, usually used to change the preset
  compression level or block size. Thanks to shasta.
• ap/cups-filters-1.20.3-x86_64-2.txz
  Recompiled against poppler-0.65.0.
• kde/calligra-2.9.11-x86_64-21.txz
  Recompiled against poppler-0.65.0.
• n/crda-3.18-x86_64-7.txz
  Upgraded to wireless-regdb-2018.05.09.
• t/texlive-2017.171108-x86_64-6.txz
  Recompiled against poppler-0.65.0.
• x/intel-gpu-tools-1.22-x86_64-3.txz
  Recompiled against procps-ng-3.3.15.
• xfce/tumbler-0.2.1-x86_64-3.txz
  Recompiled against poppler-0.65.0.
• isolinux/initrd.img
• usb-and-pxe-installers/usbboot.img

• a/aaa_elflibs-14.2-x86_64-39.txz
  Restored libstdc++.so.5. Upgraded libidn and libidn2.

• ap/vim-8.1.0001-x86_64-1.txz
• l/libidn2-2.0.5-x86_64-1.txz
• x/mesa-18.0.4-x86_64-1.txz
• x/xf86-video-mach64-6.9.6-x86_64-1.txz
• x/xf86-video-rendition-4.2.7-x86_64-1.txz
• xap/vim-gvim-8.1.0001-x86_64-1.txz

• l/babl-0.1.48-x86_64-1.txz
• l/gegl-0.4.2-x86_64-1.txz
• l/gst-plugins-base-1.14.1-x86_64-1.txz
• l/gst-plugins-good-1.14.1-x86_64-1.txz
• l/gst-plugins-libav-1.14.1-x86_64-1.txz
• l/gstreamer-1.14.1-x86_64-1.txz
• n/ca-certificates-20180409-noarch-1.txz
• n/samba-4.8.2-x86_64-1.txz
• x/libinput-1.10.7-x86_64-1.txz
• x/xf86-video-vmware-13.3.0-x86_64-1.txz
• xap/mozilla-firefox-60.0.1-x86_64-1.txz
• extra/pure-alsa-system/gst-plugins-good-1.14.1-x86_64-1_alsa.txz

• a/e2fsprogs-1.44.2-x86_64-1.txz
• a/kernel-generic-4.14.41-x86_64-1.txz
• a/kernel-huge-4.14.41-x86_64-1.txz
• a/kernel-modules-4.14.41-x86_64-1.txz
• a/usbutils-010-x86_64-1.txz
• ap/lsscsi-0.29-x86_64-1.txz
• ap/nano-2.9.7-x86_64-1.txz
• d/kernel-headers-4.14.41-x86-1.txz
• k/kernel-source-4.14.41-noarch-1.txz
• l/libgphoto2-2.5.18-x86_64-1.txz
• n/curl-7.60.0-x86_64-1.txz
  This release contains security fixes:
  FTP: shutdown response buffer overflow
  RTSP: bad headers buffer over-read
  For more information, see:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000300
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000301
  (* Security fix *)
• n/links-2.16-x86_64-1.txz
• x/xdg-utils-1.1.3-noarch-1.txz
• xfce/xfce4-terminal-0.8.7.4-x86_64-1.txz
• kernels/*

• l/libimobiledevice-1.2.0-x86_64-5.txz
  Patch to fix double free with OpenSSL-1.1.x. Thanks to ill323.
• extra/tigervnc/tigervnc-1.8.0-x86_64-5.txz
  Patched and recompiled for xorg-server-1.20.0. Thanks to Matteo Bernardini.
• isolinux/initrd.img
• usb-and-pxe-installers/usbboot.img

• pasture/php-5.6.36-x86_64-1.txz
  Since some things still require php-5.6, here's an alternate package
  compiled against openssl-1.1. Thanks to Darth Vader.

• a/openssl-solibs-1.1.0h-x86_64-2.txz
• ap/gutenprint-5.2.14-x86_64-2.txz
  Rebuilt without the gimp2 print plugin (not compatible with gimp-2.10.0).
• n/openssl-1.1.0h-x86_64-2.txz
  Fixed missing quotes in c_rehash. Thanks to Matteo Bernardini.
  After updating this package, it may be required to reinstall the
  ca-certificates package (or run: update-ca-certificates –fresh).

• ap/vim-8.0.1839-x86_64-1.txz
• x/libdmx-1.1.4-x86_64-1.txz
• xap/vim-gvim-8.0.1839-x86_64-1.txz

Where possible, the driver packages for X11 have been recompiled. However,
there were some (xf86-video-geode, xf86-video-tseng, xf86-video-sis,
xf86-video-savage, xf86-video-s3virge, xf86-video-rendition, xf86-video-r128,
and xf86-video-mach64) that would not compile against xorg-server-1.20.0 and
for which no patches seem to be available. Is anyone still using those, or are
they finally obsolete? I'll hold off on removing them until I can find out one
way or the other.

• a/aaa_elflibs-14.2-x86_64-38.txz
• a/bzip2-1.0.6-x86_64-3.txz
  Added bzip2.pc.
• ap/ghostscript-9.23-x86_64-3.txz
  Recompiled against libidn-1.35.
• l/loudmouth-1.5.3-x86_64-3.txz
  Recompiled against libidn-1.35.
• n/bind-9.11.3-x86_64-4.txz
  Recompiled against libidn-1.35.
• n/mcabber-1.0.5-x86_64-4.txz
  Recompiled against libidn-1.35.
• n/mutt-1.9.5-x86_64-4.txz
  Recompiled against libidn-1.35.
• x/xf86-input-acecad-1.5.0-x86_64-12.txz
• x/xf86-input-evdev-2.10.5-x86_64-3.txz
• x/xf86-input-joystick-1.6.3-x86_64-3.txz
• x/xf86-input-keyboard-1.9.0-x86_64-3.txz
• x/xf86-input-libinput-0.27.1-x86_64-3.txz
• x/xf86-input-mouse-1.9.2-x86_64-3.txz
• x/xf86-input-penmount-1.5.0-x86_64-12.txz
• x/xf86-input-synaptics-1.9.0-x86_64-3.txz
• x/xf86-input-vmmouse-13.1.0-x86_64-7.txz
• x/xf86-input-void-1.4.0-x86_64-12.txz
• x/xf86-input-wacom-0.36.1-x86_64-3.txz
• x/xf86-video-amdgpu-18.0.1-x86_64-3.txz
• x/xf86-video-apm-1.2.5-x86_64-11.txz
• x/xf86-video-ark-0.7.5-x86_64-11.txz
• x/xf86-video-ast-1.1.5-x86_64-5.txz
• x/xf86-video-ati-18.0.1-x86_64-3.txz
• x/xf86-video-chips-1.2.7-x86_64-3.txz
• x/xf86-video-cirrus-1.5.3-x86_64-5.txz
• x/xf86-video-dummy-0.3.8-x86_64-3.txz
• x/xf86-video-glint-1.2.9-x86_64-3.txz
• x/xf86-video-i128-1.3.6-x86_64-11.txz
• x/xf86-video-i740-1.3.6-x86_64-3.txz
• x/xf86-video-mga-1.6.5-x86_64-3.txz
• x/xf86-video-neomagic-1.2.9-x86_64-5.txz
• x/xf86-video-nouveau-1.0.15-x86_64-3.txz
• x/xf86-video-nv-2.1.21-x86_64-3.txz
• x/xf86-video-openchrome-0.6.0-x86_64-3.txz
• x/xf86-video-s3-0.6.5-x86_64-11.txz
• x/xf86-video-siliconmotion-1.7.9-x86_64-3.txz
• x/xf86-video-sisusb-0.9.7-x86_64-3.txz
• x/xf86-video-tdfx-1.4.7-x86_64-3.txz
• x/xf86-video-tga-1.2.2-x86_64-11.txz
• x/xf86-video-trident-1.3.8-x86_64-3.txz
• x/xf86-video-v4l-0.2.0-x86_64-16.txz
• x/xf86-video-vboxvideo-1.0.0-x86_64-3.txz
• x/xf86-video-vesa-2.4.0-x86_64-3.txz
• x/xf86-video-vmware-13.2.1-x86_64-7.txz
• x/xf86-video-voodoo-1.2.5-x86_64-12.txz
• xap/pidgin-2.13.0-x86_64-3.txz
  Recompiled against libidn-1.35.

• d/rust-1.26.0-x86_64-1.txz
• l/libidn-1.35-x86_64-1.txz
  Shared library .so-version bump.
• n/NetworkManager-1.10.8-x86_64-1.txz
• n/lynx-2.8.9dev.18-x86_64-1.txz
  Compiled against libidn-1.35.

• a/aaa_elflibs-14.2-x86_64-37.txz
  Restored libpng14.so.14.

• n/nghttp2-1.32.0-x86_64-1.txz
• x/libdrm-2.4.92-x86_64-1.txz
• x/xf86-video-intel-git_20180315_e7bfc906-x86_64-1.txz
• x/xorg-server-1.20.0-x86_64-1.txz
• x/xorg-server-xephyr-1.20.0-x86_64-1.txz
• x/xorg-server-xnest-1.20.0-x86_64-1.txz
• x/xorg-server-xvfb-1.20.0-x86_64-1.txz

• n/wpa_supplicant-2.6-x86_64-6.txz
  Drop the use-system-openssl-ciphers patch. Thanks to GazL.

• a/aaa_elflibs-14.2-x86_64-36.txz
• ap/hplip-3.18.4-x86_64-2.txz
  Recompiled against openssl-1.1.0h.
• ap/mariadb-10.2.14-x86_64-3.txz
  Recompiled against openssl-1.1.0h.
• d/git-2.17.0-x86_64-3.txz
  Recompiled against openssl-1.1.0h.
• d/perl-5.26.2-x86_64-3.txz
  Recompiled against openssl-1.1.0h.
• d/python-2.7.15-x86_64-2.txz
  Recompiled against openssl-1.1.0h.
• d/python3-3.6.5-x86_64-3.txz
  Recompiled against openssl-1.1.0h.
• d/ruby-2.5.1-x86_64-3.txz
  Recompiled against openssl-1.1.0h.
• d/rust-1.25.0-x86_64-3.txz
  Recompiled against openssl-1.1.0h.
• l/M2Crypto-0.27.0-x86_64-4.txz
  Recompiled against openssl-1.1.0h.
• l/apr-util-1.6.1-x86_64-7.txz
  Recompiled against openssl-1.1.0h.
• l/libarchive-3.3.2-x86_64-3.txz
  Recompiled against openssl-1.1.0h.
• l/libevent-2.1.8-x86_64-3.txz
  Recompiled against openssl-1.1.0h.
• l/libimobiledevice-1.2.0-x86_64-4.txz
  Recompiled against openssl-1.1.0h.
• l/libssh2-1.8.0-x86_64-3.txz
  Recompiled against openssl-1.1.0h.
• l/libvncserver-0.9.11-x86_64-4.txz
  Recompiled against openssl-1.1.0h.
• l/libzip-1.5.1-x86_64-3.txz
  Recompiled against openssl-1.1.0h.
• l/opusfile-0.9-x86_64-4.txz
  Recompiled against openssl-1.1.0h.
• l/pulseaudio-11.1-x86_64-3.txz
  Recompiled against openssl-1.1.0h.
• l/pycurl-7.43.0.1-x86_64-3.txz
  Recompiled against openssl-1.1.0h.
• l/qca-2.1.3-x86_64-3.txz
  Recompiled against openssl-1.1.0h.
• l/qt-4.8.7-x86_64-10.txz
  Recompiled against openssl-1.1.0h.
• l/redland-1.0.17-x86_64-5.txz
  Recompiled against openssl-1.1.0h.
• l/serf-1.3.9-x86_64-3.txz
  Recompiled against openssl-1.1.0h.
• n/alpine-2.21-x86_64-3.txz
  Recompiled against openssl-1.1.0h.
• n/bind-9.11.3-x86_64-3.txz
  Recompiled against openssl-1.1.0h.
• n/curl-7.59.0-x86_64-4.txz
  Recompiled against openssl-1.1.0h.
• n/dovecot-2.3.1-x86_64-4.txz
  Recompiled against openssl-1.1.0h.
• n/epic5-2.0.1-x86_64-5.txz
  Recompiled against openssl-1.1.0h.
• n/fetchmail-6.3.26-x86_64-4.txz
  Recompiled against openssl-1.1.0h.
• n/htdig-3.2.0b6-x86_64-6.txz
  Recompiled against openssl-1.1.0h.
• n/httpd-2.4.33-x86_64-4.txz
  Recompiled against openssl-1.1.0h.
• n/irssi-1.1.1-x86_64-3.txz
  Recompiled against openssl-1.1.0h.
• n/lftp-4.8.3-x86_64-3.txz
  Recompiled against openssl-1.1.0h.
• n/links-2.14-x86_64-4.txz
  Recompiled against openssl-1.1.0h.
• n/lynx-2.8.9dev.16-x86_64-2.txz
  Recompiled against openssl-1.1.0h.
• n/mailx-12.5-x86_64-4.txz
  Recompiled against openssl-1.1.0h.
• n/mutt-1.9.5-x86_64-3.txz
  Recompiled against openssl-1.1.0h.
• n/net-snmp-5.7.3-x86_64-8.txz
  Recompiled against openssl-1.1.0h.
• n/nmap-7.70-x86_64-3.txz
  Recompiled against openssl-1.1.0h.
• n/ntp-4.2.8p11-x86_64-3.txz
  Recompiled against openssl-1.1.0h.
• n/openldap-client-2.4.46-x86_64-3.txz
  Recompiled against openssl-1.1.0h.
• n/openssh-7.7p1-x86_64-5.txz
  Recompiled against openssl-1.1.0h.
  Thanks to alienBOB for the patch.
• n/openvpn-2.4.6-x86_64-2.txz
  Recompiled against openssl-1.1.0h.
• n/php-7.2.5-x86_64-2.txz
  Recompiled against openssl-1.1.0h.
• n/pidentd-3.0.19-x86_64-4.txz
  Recompiled against openssl-1.1.0h.
• n/popa3d-1.0.3-x86_64-3.txz
  Recompiled against openssl-1.1.0h.
• n/postfix-3.3.0-x86_64-4.txz
  Recompiled against openssl-1.1.0h.
• n/proftpd-1.3.6-x86_64-4.txz
  Recompiled against openssl-1.1.0h.
• n/slrn-1.0.2-x86_64-3.txz
  Recompiled against openssl-1.1.0h.
• n/stunnel-5.44-x86_64-3.txz
  Recompiled against openssl-1.1.0h.
• n/tcpdump-4.9.2-x86_64-3.txz
  Recompiled against openssl-1.1.0h.
• n/ulogd-2.0.5-x86_64-4.txz
  Recompiled against openssl-1.1.0h.
• n/vsftpd-3.0.3-x86_64-5.txz
  Recompiled against openssl-1.1.0h.
• n/wpa_supplicant-2.6-x86_64-5.txz
  Recompiled against openssl-1.1.0h.
• xap/gftp-2.0.19-x86_64-7.txz
  Recompiled against openssl-1.1.0h.
• xap/gkrellm-2.3.10-x86_64-4.txz
  Recompiled against openssl-1.1.0h.
• xap/hexchat-2.14.1-x86_64-3.txz
  Recompiled against openssl-1.1.0h.
• xap/rdesktop-1.8.3-x86_64-3.txz
  Recompiled against openssl-1.1.0h.
• xap/sane-1.0.27-x86_64-3.txz
  Recompiled against openssl-1.1.0h.
• xap/x3270-3.3.12ga7-x86_64-4.txz
  Recompiled against openssl-1.1.0h.
• extra/sendmail/sendmail-8.15.2-x86_64-3.txz
  Recompiled against openssl-1.1.0h.
• extra/sendmail/sendmail-cf-8.15.2-noarch-3.txz
• isolinux/initrd.img
• usb-and-pxe-installers/usbboot.img

• a/glibc-zoneinfo-2018e-noarch-1.txz
• a/kernel-firmware-20180507_8fc2d4e-noarch-1.txz
• a/kernel-generic-4.14.40-x86_64-1.txz
• a/kernel-huge-4.14.40-x86_64-1.txz
• a/kernel-modules-4.14.40-x86_64-1.txz
• a/openssl-solibs-1.1.0h-x86_64-1.txz
• d/kernel-headers-4.14.40-x86-1.txz
• k/kernel-source-4.14.40-noarch-1.txz
• l/gnome-keyring-3.28.2-x86_64-1.txz
• l/gvfs-1.36.2-x86_64-1.txz
• l/librsvg-2.42.4-x86_64-1.txz
• l/libsoup-2.62.2-x86_64-1.txz
• l/neon-0.30.2-x86_64-1.txz
  Compiled against openssl-1.1.0h.
• n/cyrus-sasl-2.1.27_rc7-x86_64-1.txz
  Compiled against openssl-1.1.0h.
• n/libgpg-error-1.31-x86_64-1.txz
• n/openssl-1.1.0h-x86_64-1.txz
  Shared library .so-version bump.
• n/snownews-1.5.13_20180507-x86_64-1.txz
  Compiled against openssl-1.1.0h.
• n/wget-1.19.5-x86_64-1.txz
  Fixed a security issue where a malicious web server could inject arbitrary
  cookies into the cookie jar file.
  For more information, see:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0494
  (* Security fix *)
  Compiled against openssl-1.1.0h.
• t/fig2dev-3.2.7a-x86_64-1.txz
• t/xfig-3.2.7a-x86_64-1.txz
• x/mesa-18.0.3-x86_64-1.txz
• xap/gnuplot-5.2.3-x86_64-1.txz
• xap/mozilla-firefox-60.0-x86_64-1.txz
  This release contains security fixes and improvements.
  For more information, see:
  https://www.mozilla.org/security/known-vulnerabilities/firefox.html
  https://www.mozilla.org/en-US/security/advisories/mfsa2018-11/
  (* Security fix *)
• kernels/*

• a/openssl10-solibs-1.0.2o-x86_64-1.txz
  Added compatibility libraries for binaries that need to remain compiled
  against openssl-1.0.2.
• n/openssl10-1.0.2o-x86_64-1.txz
  Added a compatibility development package for sources that need to be
  compiled against openssl-1.0.2o. To compile against openssl-1.0.2o, you'll
  need to add lines like this to the build script:
  export CFLAGS=“$CFLAGS -I/usr/include/openssl-1.0”
  export LIBS=“-L/usr/lib${LIBDIRSUFFIX}/openssl-1.0”
  Some sources may still make a mess of things, and in those cases it might be
  easiest to temporarily remove the openssl (1.1.0h) package while compiling,
  in addition to the changes shown above.
  The shared libraries in this package (and also duplicated in the
  openssl10-solibs package) have also been changed to use versioned symbols.
  Old binaries and libraries will continue to run linked with these new
  libraries, but it is suggested to recompile them if possible. This will
  prevent problems in case something ends up linking both the 1.0.2 and the
  1.1.0 OpenSSL libraries.

• d/python-2.7.15-x86_64-1.txz
  Updated to the latest 2.7.x release.
  This fixes some security issues in difflib and poplib (regexes vulnerable
  to denial of service attacks), as well as security issues with the bundled
  expat library.
  For more information, see:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0876
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0718
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0718
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4472
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5300
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9063
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9233
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1060
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1061
  (* Security fix *)
• x/xterm-333-x86_64-1.txz
• xap/xlockmore-5.55-x86_64-1.txz
  Compiled against imagemagick-6.9.9_42.

• e/emacs-25.3-x86_64-4.txz
  Recompiled against imagemagick-6.9.9_42.
• l/virtuoso-ose-6.1.8-x86_64-9.txz
  Recompiled against imagemagick-6.9.9_42.
• xap/xine-lib-1.2.9-x86_64-3.txz
  Recompiled against imagemagick-6.9.9_42.

• l/imagemagick-6.9.9_42-x86_64-1.txz
  Shared library .so-version bump.
• l/seamonkey-solibs-2.49.3-x86_64-1.txz
• xap/seamonkey-2.49.3-x86_64-1.txz
  This update contains security fixes and improvements.
  For more information (when it appears), see:
  http://www.seamonkey-project.org/releases/seamonkey2.49.3
  (* Security fix *)

• a/kernel-firmware-20180430_397a604-noarch-1.txz
• a/kernel-generic-4.14.39-x86_64-1.txz
• a/kernel-huge-4.14.39-x86_64-1.txz
• a/kernel-modules-4.14.39-x86_64-1.txz
• d/kernel-headers-4.14.39-x86-1.txz
• k/kernel-source-4.14.39-noarch-1.txz
• l/LibRaw-0.18.10-x86_64-1.txz
  Fixes some minor security issues.
  For more information, see:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13735
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14265
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14348
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10528
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10529
  (* Security fix *)
• l/libaio-0.3.111-x86_64-1.txz
• n/dhcpcd-7.0.4-x86_64-1.txz
• n/gnupg2-2.2.7-x86_64-1.txz
• kernels/*

• isolinux/initrd.img
• usb-and-pxe-installers/usbboot.img

• a/dbus-1.12.8-x86_64-1.txz
• a/xfsprogs-4.16.1-x86_64-1.txz
• ap/hplip-3.18.4-x86_64-1.txz
• ap/man-pages-4.16-noarch-1.txz
• l/gegl-0.4.0-x86_64-1.txz
• x/libinput-1.10.6-x86_64-1.txz
• xap/gimp-2.10.0-x86_64-1.txz

• a/eudev-3.2.5-x86_64-3.txz
  Don't treat bind actions as add/update actions. Fixes MTP with recent
  kernels. Thanks to DarkVision for the link to the patch.

• l/gexiv2-0.10.8-x86_64-1.txz
  Required by gimp-2.10.0.
• l/json-c-0.13.1_20180305-x86_64-1.txz
  Looks like we're getting this package back since libmypaint needs it.
• l/json-glib-1.4.2-x86_64-1.txz
  Required by gegl-0.4.0 and gimp-2.10.0.
• x/libmypaint-1.3.0-x86_64-1.txz
  Required by gimp-2.10.0.
• x/mypaint-brushes-1.3.0-noarch-1.txz
  Required by gimp-2.10.0.