Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package runc for openSUSE:Factory checked in at 2026-07-17 18:47:29 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/runc (Old) and /work/SRC/openSUSE:Factory/.runc.new.24530 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "runc" Fri Jul 17 18:47:29 2026 rev:81 rq:1366218 version:1.4.3 Changes: -------- --- /work/SRC/openSUSE:Factory/runc/runc.changes 2026-06-29 17:30:38.502611058 +0200 +++ /work/SRC/openSUSE:Factory/.runc.new.24530/runc.changes 2026-07-17 18:48:09.854590125 +0200 @@ -1,0 +2,21 @@ +Thu Jul 16 14:30:06 UTC 2026 - Dirk Müller <[email protected]> + +- update to 1.4.3 (bsc#1268275, CVE-2026-41579): + * [CVE-2026-41579][] allowed a malicious image with a `/dev` + symlink to have limited write access to the host filesystem in + ways that our analysis indicates was too limited to be + problematic in practice. This bug was very similar to those + fixed in [CVE-2025-31133][], [CVE-2025-52565][], + [CVE-2025-31133][] and was simply missed at the time when we + hardened the rootfs preparation code. We have conducted a + deeper audit and not found any other problematic cases. + * Various integration test improvements. (#5222, #5237, #5226, + #5229, #5239, #5249, #5269, #5287, #5295, #5304) + * When masking directories with `maskPaths`, runc will now re- + use a single `tmpfs` instance (which is not writeable) to + reduce the number `tmpfs` superblocks that need to be reaped + when containers die (in particular, Kubernetes applies masks + to per-CPU sysfs directories which get expensive quickly). +- add vendor.tar.gz to bump x/net + +------------------------------------------------------------------- Old: ---- runc-1.4.2.tar.xz runc-1.4.2.tar.xz.asc New: ---- _service runc-1.4.3.tar.xz runc-1.4.3.tar.xz.asc vendor.tar.zst ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ runc.spec ++++++ --- /var/tmp/diff_new_pack.ox1lOU/_old 2026-07-17 18:48:10.530612918 +0200 +++ /var/tmp/diff_new_pack.ox1lOU/_new 2026-07-17 18:48:10.530612918 +0200 @@ -21,13 +21,13 @@ %bcond_with libpathrs # MANUAL: Make sure you update this each time you update runc. -%define git_version c67132530367ecd401dbe800bf13b96052212f3f -%define git_short c67132530367 +%define git_version bb14dabeb7185bb72c8c86735d090dcb20f36587 +%define git_short bb14dabe %define project github.com/opencontainers/runc Name: runc -Version: 1.4.2 +Version: 1.4.3 %define upstream_version %{version} Release: 0 Summary: Tool for spawning and running OCI containers @@ -37,12 +37,13 @@ Source0: https://github.com/opencontainers/runc/releases/download/v%{upstream_version}/runc.tar.xz#/runc-%{upstream_version}.tar.xz Source1: https://github.com/opencontainers/runc/releases/download/v%{upstream_version}/runc.tar.xz.asc#/runc-%{upstream_version}.tar.xz.asc Source2: runc.keyring +Source9: vendor.tar.zst BuildRequires: diffutils BuildRequires: fdupes -BuildRequires: go >= 1.23 BuildRequires: go-go-md2man BuildRequires: libseccomp-devel BuildRequires: libselinux-devel +BuildRequires: golang(API) >= 1.24 %if 0%{with libpathrs} BuildRequires: libpathrs-devel %endif ++++++ _service ++++++ <services> <service name="go_modules" mode="manual"> <param name="compression">zst</param> <param name="replace">golang.org/x/net=golang.org/x/[email protected]</param> </service> </services> ++++++ runc-1.4.2.tar.xz -> runc-1.4.3.tar.xz ++++++ ++++ 2390 lines of diff (skipped)
