Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package protobuf for openSUSE:Factory checked in at 2026-04-09 16:08:02 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/protobuf (Old) and /work/SRC/openSUSE:Factory/.protobuf.new.21863 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "protobuf" Thu Apr 9 16:08:02 2026 rev:95 rq:1343383 version:34.1 Changes: -------- --- /work/SRC/openSUSE:Factory/protobuf/protobuf-java.changes 2026-01-14 16:20:07.029549128 +0100 +++ /work/SRC/openSUSE:Factory/.protobuf.new.21863/protobuf-java.changes 2026-04-09 16:09:49.373701600 +0200 @@ -1,0 +2,39 @@ +Sat Mar 28 12:43:48 UTC 2026 - Andreas Stieger <[email protected]> + +- update to 34.1: + * Add support for bazel 9.x + * Bazel: Moved protocopt flag out of the cc dir, since it is not + a c++-specific flag + * C++: Add cc_proto_library for MessageSet in + //src/google/protobuf/bridge + * Java: Avoid toBigIntegerExact in JsonFormat to avoid degenerate + parse behavior in the face of large exponents + +------------------------------------------------------------------- +Sat Mar 14 17:40:11 UTC 2026 - Andreas Stieger <[email protected]> + +- update to 34.0: + * potentially breaking changes to Objective-C, Python, PHP, C++, + driven by feature additions, bug fixes and updatres, removal or + replacements of interfaces and functions + * potentiallly breaking changes to Bazel: + --proto_toolchain_for* and --proto_compiler are no longer read + See https://protobuf.dev/news/2026-03-13/ + +------------------------------------------------------------------- +Thu Mar 5 17:09:43 UTC 2026 - Andreas Stieger <[email protected]> + +- update to 33.5: + * Fix Any recursion depth bypass in Python json_format.ParseDict + (boo#1257173, CVE-2026-0994), drop CVE-2026-0994.patch +- includes changes form 33.4: + * Bazel: Remove hardcoded dependency on //:protoc from language + runtimes + +------------------------------------------------------------------- +Mon Jan 26 13:00:51 UTC 2026 - John Paul Adrian Glaubitz <[email protected]> + +- Add CVE-2026-0994.patch to fix google.protobuf.Any recursion depth + bypass in Python json_format.ParseDict (bsc#1257173, CVE-2026-0994) + +------------------------------------------------------------------- protobuf.changes: same change python-protobuf.changes: same change Old: ---- protobuf-33.3.tar.gz protobuf-6.33.3.tar.gz protobuf-java-4.33.3.pom protobuf-java-util-4.33.3.pom protobuf-javalite-4.33.3.pom New: ---- protobuf-34.1.tar.gz protobuf-7.34.1.tar.gz protobuf-java-4.34.1.pom protobuf-java-util-4.34.1.pom protobuf-javalite-4.34.1.pom ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ protobuf-java.spec ++++++ --- /var/tmp/diff_new_pack.GGWEfS/_old 2026-04-09 16:09:54.029894403 +0200 +++ /var/tmp/diff_new_pack.GGWEfS/_new 2026-04-09 16:09:54.033894569 +0200 @@ -1,7 +1,7 @@ # # spec file for package protobuf-java # -# Copyright (c) 2025 SUSE LLC and contributors +# Copyright (c) 2026 SUSE LLC and contributors # Copyright (c) 2026 Andreas Stieger <[email protected]> # # All modifications and additions to the file contributed by third parties @@ -19,7 +19,7 @@ %define tarname protobuf Name: protobuf-java -Version: 33.3 +Version: 34.1 Release: 0 Summary: Java Bindings for Google Protocol Buffers License: BSD-3-Clause ++++++ protobuf.spec ++++++ --- /var/tmp/diff_new_pack.GGWEfS/_old 2026-04-09 16:09:54.077896391 +0200 +++ /var/tmp/diff_new_pack.GGWEfS/_new 2026-04-09 16:09:54.081896556 +0200 @@ -1,7 +1,7 @@ # # spec file for package protobuf # -# Copyright (c) 2025 SUSE LLC and contributors +# Copyright (c) 2026 SUSE LLC and contributors # Copyright (c) 2026 Andreas Stieger <[email protected]> # # All modifications and additions to the file contributed by third parties @@ -20,7 +20,7 @@ %define tarname protobuf # see cmake/abseil-cpp.cmake and src/google/protobuf/port_def.inc %define abseil_min_version 20250512.1 -%global sover 33_3_0 +%global sover 34_1_0 %if 0%{?gcc_version} < 11 %define with_gcc 11 %endif @@ -66,7 +66,7 @@ %global protoc_arch sparc_64 %endif Name: protobuf -Version: 33.3 +Version: 34.1 Release: 0 Summary: Protocol Buffers - Google's data interchange format License: BSD-3-Clause @@ -105,6 +105,7 @@ BuildRequires: pkgconfig(absl_memory) >= %{abseil_min_version} BuildRequires: pkgconfig(absl_node_hash_map) >= %{abseil_min_version} BuildRequires: pkgconfig(absl_node_hash_set) >= %{abseil_min_version} +BuildRequires: pkgconfig(absl_optional) >= %{abseil_min_version} BuildRequires: pkgconfig(absl_random_distributions) >= %{abseil_min_version} BuildRequires: pkgconfig(absl_random_random) >= %{abseil_min_version} BuildRequires: pkgconfig(absl_span) >= %{abseil_min_version} @@ -113,7 +114,6 @@ BuildRequires: pkgconfig(absl_strings) >= %{abseil_min_version} BuildRequires: pkgconfig(absl_synchronization) >= %{abseil_min_version} BuildRequires: pkgconfig(absl_time) >= %{abseil_min_version} -BuildRequires: pkgconfig(absl_type_traits) >= %{abseil_min_version} BuildRequires: pkgconfig(absl_utility) >= %{abseil_min_version} BuildRequires: pkgconfig(zlib) %if %{with check} ++++++ python-protobuf.spec ++++++ --- /var/tmp/diff_new_pack.GGWEfS/_old 2026-04-09 16:09:54.125898378 +0200 +++ /var/tmp/diff_new_pack.GGWEfS/_new 2026-04-09 16:09:54.125898378 +0200 @@ -1,7 +1,7 @@ # # spec file for package python-protobuf # -# Copyright (c) 2025 SUSE LLC and contributors +# Copyright (c) 2026 SUSE LLC and contributors # Copyright (c) 2026 Andreas Stieger <[email protected]> # # All modifications and additions to the file contributed by third parties @@ -17,10 +17,10 @@ # -%define baseversion 33.3 +%define baseversion 34.1 %{?sle15_python_module_pythons} Name: python-protobuf -Version: 6.%{baseversion} +Version: 7.%{baseversion} Release: 0 Summary: Python Bindings for Google Protocol Buffers License: BSD-3-Clause @@ -43,7 +43,7 @@ This package contains the Python bindings for Google Protocol Buffers. %prep -%autosetup -p2 -n protobuf-%{version} +%autosetup -p1 -n protobuf-%{version} # The previous blank line is crucial for older system being able # to use the autosetup macro ++++++ baselibs.conf ++++++ --- /var/tmp/diff_new_pack.GGWEfS/_old 2026-04-09 16:09:54.181900697 +0200 +++ /var/tmp/diff_new_pack.GGWEfS/_new 2026-04-09 16:09:54.185900863 +0200 @@ -1,5 +1,5 @@ -libprotobuf33_3_0 -libprotoc33_3_0 -libprotobuf-lite33_3_0 -libutf8_range-33_3_0 +libprotobuf34_1_0 +libprotoc34_1_0 +libprotobuf-lite34_1_0 +libutf8_range-34_1_0 ++++++ protobuf-33.3.tar.gz -> protobuf-34.1.tar.gz ++++++ /work/SRC/openSUSE:Factory/protobuf/protobuf-33.3.tar.gz /work/SRC/openSUSE:Factory/.protobuf.new.21863/protobuf-34.1.tar.gz differ: char 5, line 1 ++++++ protobuf-6.33.3.tar.gz -> protobuf-7.34.1.tar.gz ++++++ ++++ 22229 lines of diff (skipped) ++++++ protobuf-java-4.33.3.pom -> protobuf-java-4.34.1.pom ++++++ --- /work/SRC/openSUSE:Factory/protobuf/protobuf-java-4.33.3.pom 2026-01-14 16:20:06.669534149 +0100 +++ /work/SRC/openSUSE:Factory/.protobuf.new.21863/protobuf-java-4.34.1.pom 2026-04-09 16:09:49.357700937 +0200 @@ -4,7 +4,7 @@ <parent> <groupId>com.google.protobuf</groupId> <artifactId>protobuf-parent</artifactId> - <version>4.33.3</version> + <version>4.34.1</version> </parent> <artifactId>protobuf-java</artifactId> ++++++ protobuf-java-util-4.33.3.pom -> protobuf-java-util-4.34.1.pom ++++++ --- /work/SRC/openSUSE:Factory/protobuf/protobuf-java-util-4.33.3.pom 2026-01-14 16:20:06.869542471 +0100 +++ /work/SRC/openSUSE:Factory/.protobuf.new.21863/protobuf-java-util-4.34.1.pom 2026-04-09 16:09:49.361701103 +0200 @@ -4,7 +4,7 @@ <parent> <groupId>com.google.protobuf</groupId> <artifactId>protobuf-parent</artifactId> - <version>4.33.3</version> + <version>4.34.1</version> </parent> <artifactId>protobuf-java-util</artifactId> @@ -16,7 +16,7 @@ <dependency> <groupId>com.google.protobuf</groupId> <artifactId>protobuf-java</artifactId> - <version>4.33.3</version> + <version>4.34.1</version> </dependency> <dependency> <groupId>com.google.code.findbugs</groupId> ++++++ protobuf-javalite-4.33.3.pom -> protobuf-javalite-4.34.1.pom ++++++ --- /work/SRC/openSUSE:Factory/protobuf/protobuf-javalite-4.33.3.pom 2026-01-14 16:20:07.357562776 +0100 +++ /work/SRC/openSUSE:Factory/.protobuf.new.21863/protobuf-javalite-4.34.1.pom 2026-04-09 16:09:49.385702097 +0200 @@ -4,7 +4,7 @@ <parent> <groupId>com.google.protobuf</groupId> <artifactId>protobuf-parent</artifactId> - <version>4.33.3</version> + <version>4.34.1</version> </parent> <artifactId>protobuf-javalite</artifactId>
