Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package goshs for openSUSE:Factory checked in at 2026-08-04 21:33:50 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/goshs (Old) and /work/SRC/openSUSE:Factory/.goshs.new.16738 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "goshs" Tue Aug 4 21:33:50 2026 rev:15 rq:1369250 version:2.1.5 Changes: -------- --- /work/SRC/openSUSE:Factory/goshs/goshs.changes 2026-07-06 12:30:49.188239610 +0200 +++ /work/SRC/openSUSE:Factory/.goshs.new.16738/goshs.changes 2026-08-04 21:34:16.699855637 +0200 @@ -1,0 +2,27 @@ +Mon Aug 3 07:24:50 UTC 2026 - Martin Hauke <[email protected]> + +- Update to version 2.1.5 + Security + * HTTP/WebDAV --no-delete/--upload-only overwrite bypass + (GHSA-966r-mw4j-rv64, Critical). + * ConPtyShell.ps1 unauthenticated exemption bypass + (GHSA-6m5c-fv2q-jrj2, Critical). + * WebDAV POST returns file contents, bypassing --upload-only + (GHSA-rc9g-fmpg-c6pp, High). + * Trailing-slash ACL and hidden-file bypass in sendFile + (GHSA-964w-f6gj-5236, Medium). + * Single-file ?share redemption served with an empty ACL + (GHSA-mqvv-v9g7-4h3j, Medium). + * SFTP server ignored --no-delete (GHSA-4wh5-87mw-whxf, Medium). + New Features + * Password reveal popup in the TUI — The --tui status bar shows + the basic-auth user but never the password. Pressing p (in any + pane except the generator, where p edits LPORT) now opens a + modal overlay with the credentials — masked until u toggles + plaintext, y/c copy, esc/q close. Handy when the password was + generated inline at launch (e.g. -b "user:$(xkcdpass ...)"). + A bcrypt-hashed secret is shown but flagged as unrecoverable. +- Added a 1 second sleep to the shell completion generation to + workaround timing issues. + +------------------------------------------------------------------- Old: ---- goshs-2.1.4.tar.gz New: ---- goshs-2.1.5.tar.gz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ goshs.spec ++++++ --- /var/tmp/diff_new_pack.4EiX6f/_old 2026-08-04 21:34:17.587886652 +0200 +++ /var/tmp/diff_new_pack.4EiX6f/_new 2026-08-04 21:34:17.591886792 +0200 @@ -16,14 +16,14 @@ # Name: goshs -Version: 2.1.4 +Version: 2.1.5 Release: 0 Summary: A simple HTTP server License: MIT Group: Productivity/Networking/Web/Servers URL: https://goshs.de/ -#Git-Clone: https://github.com/patrickhener/goshs.git -Source: https://github.com/patrickhener/goshs/archive/refs/tags/v%{version}.tar.gz#/%{name}-%{version}.tar.gz +#Git-Clone: https://github.com/goshs-labs/goshs.git +Source: https://github.com/goshs-labs/goshs/archive/refs/tags/v%{version}.tar.gz#/%{name}-%{version}.tar.gz Source1: vendor.tar.gz BuildRequires: bash-completion BuildRequires: zsh @@ -54,6 +54,7 @@ for shell in bash fish zsh; do %{buildroot}%{_bindir}/goshs --completion "$shell" + sleep 1; done install -Dm 0644 /home/abuild/.local/share/bash-completion/completions/goshs %{buildroot}/%{_datadir}/bash-completion/completions/%{name}.bash install -Dm 0644 /home/abuild/.config/fish/completions/goshs.fish %{buildroot}%{_datadir}/fish/vendor_completions.d/%{name}.fish ++++++ goshs-2.1.4.tar.gz -> goshs-2.1.5.tar.gz ++++++ ++++ 2888 lines of diff (skipped) ++++++ vendor.tar.gz ++++++ /work/SRC/openSUSE:Factory/goshs/vendor.tar.gz /work/SRC/openSUSE:Factory/.goshs.new.16738/vendor.tar.gz differ: char 48, line 1
