Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package zizmor for openSUSE:Factory checked in at 2026-07-22 19:05:18 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/zizmor (Old) and /work/SRC/openSUSE:Factory/.zizmor.new.24530 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "zizmor" Wed Jul 22 19:05:18 2026 rev:37 rq:1367079 version:1.28.0 Changes: -------- --- /work/SRC/openSUSE:Factory/zizmor/zizmor.changes 2026-07-15 16:57:19.210431500 +0200 +++ /work/SRC/openSUSE:Factory/.zizmor.new.24530/zizmor.changes 2026-07-22 19:07:48.218603087 +0200 @@ -1,0 +2,28 @@ +Wed Jul 22 06:31:29 UTC 2026 - Johannes Kastl <[email protected]> + +- Update to version 1.28.0: + * Security + - v1.27.0 contained a logging defect that would print any + configured GitHub credentials as part of zizmor's cleartext + logging. No versions other than v1.27.0 were affected. See + GHSA-f42p-wjw5-97qh for full information. + - Many thanks to @shaanmajid for finding and reporting this + vulnerability. + * Enhancements + - The JSON (v1) output format now includes metadata for each + finding's fixes, if the finding has fixes (#2186) + - The dependabot-cooldown audit is now aware of GitHub's new + three-day default cooldown (#2193) + - sbt is now recognized as a package-ecosystem in + dependabot.yml (#2211) + * Bug Fixes + - Fixed a bug where the template-injection audit would + incorrectly flag steps..outcome and steps..conclusion as + injection risks in the default persona (#2199) + - Fixed a bug where the github-env audit would incorrectly flag + some printf calls as exploitable (#2201) + - Fixed a bug where zizmor would produce a misleading and + confusing error message when asked to audit an ambiguous + remote input (#2205) + +------------------------------------------------------------------- Old: ---- zizmor-1.27.0.obscpio New: ---- zizmor-1.28.0.obscpio ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ zizmor.spec ++++++ --- /var/tmp/diff_new_pack.mZsO9c/_old 2026-07-22 19:07:48.918627059 +0200 +++ /var/tmp/diff_new_pack.mZsO9c/_new 2026-07-22 19:07:48.918627059 +0200 @@ -17,7 +17,7 @@ Name: zizmor -Version: 1.27.0 +Version: 1.28.0 Release: 0 Summary: A static analysis tool for GitHub Actions License: MIT @@ -26,7 +26,7 @@ Source1: vendor.tar.zst BuildRequires: bash-completion BuildRequires: ca-certificates-mozilla -BuildRequires: cargo >= 1.80 +BuildRequires: cargo >= 1.97 BuildRequires: cargo-packaging BuildRequires: fish BuildRequires: zsh ++++++ _service ++++++ --- /var/tmp/diff_new_pack.mZsO9c/_old 2026-07-22 19:07:48.970628839 +0200 +++ /var/tmp/diff_new_pack.mZsO9c/_new 2026-07-22 19:07:48.974628977 +0200 @@ -4,7 +4,7 @@ <param name="scm">git</param> <param name="exclude">.git</param> <param name="versionformat">@PARENT_TAG@</param> - <param name="revision">refs/tags/v1.27.0</param> + <param name="revision">refs/tags/v1.28.0</param> <param name="versionrewrite-pattern">v(.*)</param> <param name="changesgenerate">enable</param> </service> ++++++ _servicedata ++++++ --- /var/tmp/diff_new_pack.mZsO9c/_old 2026-07-22 19:07:48.998629799 +0200 +++ /var/tmp/diff_new_pack.mZsO9c/_new 2026-07-22 19:07:49.002629935 +0200 @@ -3,6 +3,6 @@ <param name="url">https://github.com/woodruffw/zizmor</param> <param name="changesrevision">597db4d7dc5730bdc1370197bf5678a5ca028abb</param></service><service name="tar_scm"> <param name="url">https://github.com/zizmorcore/zizmor.git</param> - <param name="changesrevision">e2627367eb7c917a90503ce05a66872fd91da6fb</param></service></servicedata> + <param name="changesrevision">4381cc6339bb76a1004a99da929fe8f8f1143d94</param></service></servicedata> (No newline at EOF) ++++++ vendor.tar.zst ++++++ /work/SRC/openSUSE:Factory/zizmor/vendor.tar.zst /work/SRC/openSUSE:Factory/.zizmor.new.24530/vendor.tar.zst differ: char 7, line 1 ++++++ zizmor-1.27.0.obscpio -> zizmor-1.28.0.obscpio ++++++ ++++ 2603 lines of diff (skipped) ++++++ zizmor.obsinfo ++++++ --- /var/tmp/diff_new_pack.mZsO9c/_old 2026-07-22 19:07:49.858659249 +0200 +++ /var/tmp/diff_new_pack.mZsO9c/_new 2026-07-22 19:07:49.866659523 +0200 @@ -1,5 +1,5 @@ name: zizmor -version: 1.27.0 -mtime: 1784015993 -commit: e2627367eb7c917a90503ce05a66872fd91da6fb +version: 1.28.0 +mtime: 1784671213 +commit: 4381cc6339bb76a1004a99da929fe8f8f1143d94
