Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package buildpacks-cli for openSUSE:Factory checked in at 2026-08-11 17:11:23 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/buildpacks-cli (Old) and /work/SRC/openSUSE:Factory/.buildpacks-cli.new.17972 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "buildpacks-cli" Tue Aug 11 17:11:23 2026 rev:22 rq:1370452 version:0.40.9 Changes: -------- --- /work/SRC/openSUSE:Factory/buildpacks-cli/buildpacks-cli.changes 2026-07-14 13:51:29.182188496 +0200 +++ /work/SRC/openSUSE:Factory/.buildpacks-cli.new.17972/buildpacks-cli.changes 2026-08-11 17:11:54.632763509 +0200 @@ -1,0 +2,12 @@ +Mon Aug 10 05:09:02 UTC 2026 - Johannes Kastl <[email protected]> + +- Update to version 0.40.9: + * Security + Bump go-git, otel and klauspost/compress to fix CVEs (#2666) + Module Bump Vulnerability Severity + github.com/go-git/go-git/v5 v5.19.1 → v5.19.2 GHSA-hc8v-wwc9-vgxm High + github.com/go-git/go-git/v5 v5.19.1 → v5.19.2 GHSA-qgq7-7hm3-q39j Medium + go.opentelemetry.io/otel v1.43.0 → v1.44.0 GO-2026-5158 / CVE-2026-41178 — baggage header not length-capped Medium + github.com/klauspost/compress v1.18.6 → v1.18.7 GO-2026-5841 / GHSA-259r-337f-4rfw — OOB read in s2 — + +------------------------------------------------------------------- Old: ---- buildpacks-cli-0.40.8.obscpio New: ---- buildpacks-cli-0.40.9.obscpio ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ buildpacks-cli.spec ++++++ --- /var/tmp/diff_new_pack.a16e4m/_old 2026-08-11 17:11:57.180871446 +0200 +++ /var/tmp/diff_new_pack.a16e4m/_new 2026-08-11 17:11:57.180871446 +0200 @@ -19,7 +19,7 @@ %define executable_name pack Name: buildpacks-cli -Version: 0.40.8 +Version: 0.40.9 Release: 0 Summary: CLI for building apps using Cloud Native Buildpacks License: Apache-2.0 ++++++ _service ++++++ --- /var/tmp/diff_new_pack.a16e4m/_old 2026-08-11 17:11:57.260874835 +0200 +++ /var/tmp/diff_new_pack.a16e4m/_new 2026-08-11 17:11:57.280875682 +0200 @@ -3,7 +3,7 @@ <param name="url">https://github.com/buildpacks/pack.git</param> <param name="scm">git</param> <param name="exclude">.git</param> - <param name="revision">refs/tags/v0.40.8</param> + <param name="revision">refs/tags/v0.40.9</param> <param name="versionformat">@PARENT_TAG@</param> <param name="versionrewrite-pattern">v(.*)</param> <param name="changesgenerate">enable</param> ++++++ _servicedata ++++++ --- /var/tmp/diff_new_pack.a16e4m/_old 2026-08-11 17:11:57.304876699 +0200 +++ /var/tmp/diff_new_pack.a16e4m/_new 2026-08-11 17:11:57.312877038 +0200 @@ -3,6 +3,6 @@ <param name="url">https://github.com/buildpacks/pack</param> <param name="changesrevision">2df3b8c3b0955ea41aec010783ddfe70cbc17c56</param></service><service name="tar_scm"> <param name="url">https://github.com/buildpacks/pack.git</param> - <param name="changesrevision">3253355fca02d856b5350cbe81b6d9ae772dfafe</param></service></servicedata> + <param name="changesrevision">8210eb15f191cad25a3f7745618417270ec07709</param></service></servicedata> (No newline at EOF) ++++++ buildpacks-cli-0.40.8.obscpio -> buildpacks-cli-0.40.9.obscpio ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/buildpacks-cli-0.40.8/.grype.yaml new/buildpacks-cli-0.40.9/.grype.yaml --- old/buildpacks-cli-0.40.8/.grype.yaml 2026-07-13 14:51:26.000000000 +0200 +++ new/buildpacks-cli-0.40.9/.grype.yaml 2026-08-09 17:21:19.000000000 +0200 @@ -18,3 +18,10 @@ # docker/cli: installed v29.4.3 is already newer than the fixed v29.2.0; grype mis-orders the # +incompatible pseudo-version. Already remediated, kept here to silence the false positive. - vulnerability: GO-2026-4610 # GHSA / CVE for docker/cli auth, fixed in 29.2.0 (we ship >= 29.4.3) + # golang.org/x/crypto/openpgp is deprecated/unmaintained. The advisory is scoped to that one + # package but carries no fixed version (introduced at v0, fixed: N/A), so it matches every + # release of the module forever and cannot be remediated by bumping. pack never links openpgp: + # the only importer is go-github/v30 via acceptance/config, which is behind the `acceptance` + # build tag and is not part of the shipped binary. Confirmed by govulncheck ("your code doesn't + # appear to call") and by `go list -deps ./...` showing no x/crypto/openpgp package. + - vulnerability: GO-2026-5932 # x/crypto/openpgp unmaintained; not linked into the pack binary diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/buildpacks-cli-0.40.8/go.mod new/buildpacks-cli-0.40.9/go.mod --- old/buildpacks-cli-0.40.8/go.mod 2026-07-13 14:51:26.000000000 +0200 +++ new/buildpacks-cli-0.40.9/go.mod 2026-08-09 17:21:19.000000000 +0200 @@ -13,7 +13,7 @@ github.com/docker/docker v28.5.2+incompatible github.com/dustin/go-humanize v1.0.1 github.com/gdamore/tcell/v2 v2.13.10 - github.com/go-git/go-git/v5 v5.19.1 + github.com/go-git/go-git/v5 v5.19.2 github.com/golang/mock v1.6.0 github.com/google/go-cmp v0.7.0 github.com/google/go-containerregistry v0.21.5 @@ -109,7 +109,7 @@ github.com/inconshreveable/mousetrap v1.1.0 // indirect github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 // indirect github.com/kevinburke/ssh_config v1.2.0 // indirect - github.com/klauspost/compress v1.18.6 // indirect + github.com/klauspost/compress v1.18.7 // indirect github.com/klauspost/cpuid/v2 v2.3.0 // indirect github.com/lucasb-eyer/go-colorful v1.3.0 // indirect github.com/mattn/go-colorable v0.1.14 // indirect @@ -143,9 +143,9 @@ github.com/xeipuuv/gojsonschema v1.2.0 // indirect go.opentelemetry.io/auto/sdk v1.2.1 // indirect go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.68.0 // indirect - go.opentelemetry.io/otel v1.43.0 // indirect - go.opentelemetry.io/otel/metric v1.43.0 // indirect - go.opentelemetry.io/otel/trace v1.43.0 // indirect + go.opentelemetry.io/otel v1.44.0 // indirect + go.opentelemetry.io/otel/metric v1.44.0 // indirect + go.opentelemetry.io/otel/trace v1.44.0 // indirect go.yaml.in/yaml/v2 v2.4.3 // indirect go.yaml.in/yaml/v3 v3.0.4 // indirect golang.org/x/net v0.56.0 // indirect diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/buildpacks-cli-0.40.8/go.sum new/buildpacks-cli-0.40.9/go.sum --- old/buildpacks-cli-0.40.8/go.sum 2026-07-13 14:51:26.000000000 +0200 +++ new/buildpacks-cli-0.40.9/go.sum 2026-08-09 17:21:19.000000000 +0200 @@ -169,8 +169,8 @@ github.com/go-git/go-billy/v5 v5.9.0/go.mod h1:jCnQMLj9eUgGU7+ludSTYoZL/GGmii14RxKFj7ROgHw= github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399 h1:eMje31YglSBqCdIqdhKBW8lokaMrL3uTkpGYlE2OOT4= github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399/go.mod h1:1OCfN199q1Jm3HZlxleg+Dw/mwps2Wbk9frAWm+4FII= -github.com/go-git/go-git/v5 v5.19.1 h1:nX27AnaU43/K5bKktKwgBmR9lawoYVe1Ckg0rgzzN00= -github.com/go-git/go-git/v5 v5.19.1/go.mod h1:Pb1v0c7/g8aGQJwx9Us09W85yGoyvSwuhEGMH7zjDKQ= +github.com/go-git/go-git/v5 v5.19.2 h1:wkfn7vOlUBu8ivAWKBWisTiwJK4jYHzTF8Ndv1LyGqY= +github.com/go-git/go-git/v5 v5.19.2/go.mod h1:QqCBE1EFN5ddFmrliLQ3/ntRCUjZU3EJuwuB/jWEHjk= github.com/go-kit/kit v0.8.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as= github.com/go-logfmt/logfmt v0.3.0/go.mod h1:Qt1PoO58o5twSAckw1HlFXLmHsOX5/0LbT9GBnD5lWE= github.com/go-logfmt/logfmt v0.4.0/go.mod h1:3RMwSq7FuexP4Kalkev3ejPJsZTpXXBr9+V4qmtdjCk= @@ -234,8 +234,8 @@ github.com/kevinburke/ssh_config v1.2.0/go.mod h1:CT57kijsi8u/K/BOFA39wgDQJ9CxiF4nAY/ojJ6r6mM= github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8= github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck= -github.com/klauspost/compress v1.18.6 h1:2jupLlAwFm95+YDR+NwD2MEfFO9d4z4Prjl1XXDjuao= -github.com/klauspost/compress v1.18.6/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= +github.com/klauspost/compress v1.18.7 h1:aUyZsS4kH3QTKurYhAOwAHxllVPnOthb3vPfnF1Ehjw= +github.com/klauspost/compress v1.18.7/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= github.com/klauspost/cpuid/v2 v2.3.0 h1:S4CRMLnYUhGeDFDqkGriYKdfoFlDnMtqTiI/sFzhA9Y= github.com/klauspost/cpuid/v2 v2.3.0/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0= github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ= @@ -405,16 +405,16 @@ go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y= go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.68.0 h1:CqXxU8VOmDefoh0+ztfGaymYbhdB/tT3zs79QaZTNGY= go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.68.0/go.mod h1:BuhAPThV8PBHBvg8ZzZ/Ok3idOdhWIodywz2xEcRbJo= -go.opentelemetry.io/otel v1.43.0 h1:mYIM03dnh5zfN7HautFE4ieIig9amkNANT+xcVxAj9I= -go.opentelemetry.io/otel v1.43.0/go.mod h1:JuG+u74mvjvcm8vj8pI5XiHy1zDeoCS2LB1spIq7Ay0= -go.opentelemetry.io/otel/metric v1.43.0 h1:d7638QeInOnuwOONPp4JAOGfbCEpYb+K6DVWvdxGzgM= -go.opentelemetry.io/otel/metric v1.43.0/go.mod h1:RDnPtIxvqlgO8GRW18W6Z/4P462ldprJtfxHxyKd2PY= +go.opentelemetry.io/otel v1.44.0 h1:JjwHmHpA4iZ3wBxluu2fbbE7j4kqlE8jXyAyPXH7HqU= +go.opentelemetry.io/otel v1.44.0/go.mod h1:BMgjTHL9WPRlRjL2oZCBTL4whCGtXch2H4BhOPIAyYc= +go.opentelemetry.io/otel/metric v1.44.0 h1:1w0gILTcHdr3YI+ixLyjemwrVnsMURbTZFrSYCdDdmc= +go.opentelemetry.io/otel/metric v1.44.0/go.mod h1:8O7hanEPBNgEMmybD3s2VBKcgWOCsA6tzHBPODAiquo= go.opentelemetry.io/otel/sdk v1.43.0 h1:pi5mE86i5rTeLXqoF/hhiBtUNcrAGHLKQdhg4h4V9Dg= go.opentelemetry.io/otel/sdk v1.43.0/go.mod h1:P+IkVU3iWukmiit/Yf9AWvpyRDlUeBaRg6Y+C58QHzg= go.opentelemetry.io/otel/sdk/metric v1.43.0 h1:S88dyqXjJkuBNLeMcVPRFXpRw2fuwdvfCGLEo89fDkw= go.opentelemetry.io/otel/sdk/metric v1.43.0/go.mod h1:C/RJtwSEJ5hzTiUz5pXF1kILHStzb9zFlIEe85bhj6A= -go.opentelemetry.io/otel/trace v1.43.0 h1:BkNrHpup+4k4w+ZZ86CZoHHEkohws8AY+WTX09nk+3A= -go.opentelemetry.io/otel/trace v1.43.0/go.mod h1:/QJhyVBUUswCphDVxq+8mld+AvhXZLhe+8WVFxiFff0= +go.opentelemetry.io/otel/trace v1.44.0 h1:jxF5CsGYCe74MCRx2X4g7WsY/VBKRqqpNvXlX/6gtIk= +go.opentelemetry.io/otel/trace v1.44.0/go.mod h1:oLl1jrMQAVo6v3GAggN+1VH9VIz9iUSvW53sW1Q8PIE= go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto= go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE= go.yaml.in/yaml/v2 v2.4.3 h1:6gvOSjQoTB3vt1l+CU+tSyi/HOjfOjRLJ4YwYZGwRO0= ++++++ buildpacks-cli.obsinfo ++++++ --- /var/tmp/diff_new_pack.a16e4m/_old 2026-08-11 17:12:00.877028015 +0200 +++ /var/tmp/diff_new_pack.a16e4m/_new 2026-08-11 17:12:00.889028523 +0200 @@ -1,5 +1,5 @@ name: buildpacks-cli -version: 0.40.8 -mtime: 1783947086 -commit: 3253355fca02d856b5350cbe81b6d9ae772dfafe +version: 0.40.9 +mtime: 1786288879 +commit: 8210eb15f191cad25a3f7745618417270ec07709 ++++++ vendor.tar.gz ++++++ /work/SRC/openSUSE:Factory/buildpacks-cli/vendor.tar.gz /work/SRC/openSUSE:Factory/.buildpacks-cli.new.17972/vendor.tar.gz differ: char 62, line 1
