Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package kubeshark-cli for openSUSE:Factory checked in at 2026-08-14 22:08:33 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/kubeshark-cli (Old) and /work/SRC/openSUSE:Factory/.kubeshark-cli.new.1258 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "kubeshark-cli" Fri Aug 14 22:08:33 2026 rev:35 rq:1371123 version:53.4.0 Changes: -------- --- /work/SRC/openSUSE:Factory/kubeshark-cli/kubeshark-cli.changes 2026-05-19 17:51:52.544370876 +0200 +++ /work/SRC/openSUSE:Factory/.kubeshark-cli.new.1258/kubeshark-cli.changes 2026-08-14 22:08:59.443336949 +0200 @@ -1,0 +2,65 @@ +Fri Aug 14 05:34:33 UTC 2026 - Johannes Kastl <[email protected]> + +- Update to version 53.4.0: + Large update, please see the full changelog at + https://github.com/kubeshark/kubeshark/releases/tag/v53.4.0 + * Release Highlights + - Breaking change for SSO users. The permissions refactor + replaces the per-role action-flag schema. The AUTH_ROLES env + and flags such as canDownloadPCAP and scriptingPermissions + are gone, replaced by tap.auth.roles (a closed capabilities + vocabulary plus a namespaces scope), tap.auth.groupMapping, + tap.auth.rolesClaim and tap.auth.defaultRole (chart default + kubeshark-viewer). Role names beginning with kubeshark- are + reserved. Existing tap.auth.* values must be migrated before + upgrading. + - Kubeshark 53.4.0 completes the gated-Hub authentication + initiative end to end: the Hub now enforces authentication on + its APIs, and the CLI, Helm chart, worker and tracer all + present a real credential to it. It lands the unified + permissions model (capabilities and features, roles and SSO + group mapping, capability-gated UI) begun in 53.3.0, and it + patches two MCP input-handling vulnerabilities. Alongside + that, this release is heavily weighted toward high-throughput + live capture: batched UI streaming, cached resolver history + that removes an OOM, conditional GETs on worker and tracer + hub fetches, parallelized snapshot collection, and visible + reporting of dropped traffic instead of silent loss. + * Security + - MCP start_kubeshark argument injection (high) — a + caller-supplied pod_regex could be parsed as a flag rather + than as the positional pod regex, allowing deployment + arguments to be redirected, including the image registry. The + regex is now appended after a literal -- end-of-options + separator so cobra always treats it as positional. Affects >= + 53.1.0, < 53.4.0. GHSA-8vf2-hxg5-crqh (CVSS 7.2, CWE-88) + - MCP download_file unvalidated destination (medium) — the + caller-supplied dest is now resolved through + secureDownloadDest and confined to a base directory (the + working directory by default, relocatable with + KUBESHARK_MCP_DOWNLOAD_DIR); a dest resolving outside the + base is rejected, and Hub API path values containing .. + segments are refused. Affects >= 53.1.0, < 53.4.0. + GHSA-gj7r-p794-hhq5 (CVSS 5.3, CWE-22) + - Build-cache credential leakage — the worker build cache no + longer carries credentials or private source, and the front + build cache no longer carries the Sentry auth token or + sourcemaps. Both caches moved to private ECR rather than + public Docker Hub + - CodeQL analysis added to the CLI repository + - cilium bumped to v1.17.14 (CVE-2026-49445) in the hub + * New Features + - Gated Hub authentication — the Hub enforces authentication on + its APIs via an internalauth gate. The CLI mints a + short-lived kubeshark-cli ServiceAccount token through the + kube TokenRequest API (audience kubeshark-hub) and presents + it as X-Kubeshark-Authorization, with authorization bounded + by Kubernetes RBAC over who may create that token. It falls + back to the existing License-Key where minting is not + possible, and to anonymous when AUTH_ENABLED is off + - CLI access control — tap.auth.cli.enabled with a subjects + allowlist controls who may use the CLI against a gated Hub, + backed by a kubeshark-cli ServiceAccount and token-minter + Role + +------------------------------------------------------------------- Old: ---- kubeshark-cli-53.3.0.obscpio New: ---- kubeshark-cli-53.4.0.obscpio ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ kubeshark-cli.spec ++++++ --- /var/tmp/diff_new_pack.SX817S/_old 2026-08-14 22:09:00.227364553 +0200 +++ /var/tmp/diff_new_pack.SX817S/_new 2026-08-14 22:09:00.229364623 +0200 @@ -19,7 +19,7 @@ %define executable_name kubeshark Name: kubeshark-cli -Version: 53.3.0 +Version: 53.4.0 Release: 0 Summary: CLI for the API traffic analyzer for Kubernetes License: Apache-2.0 ++++++ _service ++++++ --- /var/tmp/diff_new_pack.SX817S/_old 2026-08-14 22:09:00.272366137 +0200 +++ /var/tmp/diff_new_pack.SX817S/_new 2026-08-14 22:09:00.277366313 +0200 @@ -1,9 +1,9 @@ <services> <service name="obs_scm" mode="manual"> - <param name="url">https://github.com/kubeshark/kubeshark</param> + <param name="url">https://github.com/kubeshark/kubeshark.git</param> <param name="scm">git</param> <param name="exclude">.git</param> - <param name="revision">v53.3.0</param> + <param name="revision">refs/tags/v53.4.0</param> <param name="versionformat">@PARENT_TAG@</param> <param name="versionrewrite-pattern">v(.*)</param> <param name="changesgenerate">enable</param> ++++++ _servicedata ++++++ --- /var/tmp/diff_new_pack.SX817S/_old 2026-08-14 22:09:00.310367475 +0200 +++ /var/tmp/diff_new_pack.SX817S/_new 2026-08-14 22:09:00.313367581 +0200 @@ -1,6 +1,8 @@ <servicedata> <service name="tar_scm"> <param name="url">https://github.com/kubeshark/kubeshark</param> - <param name="changesrevision">f97866f7471cc5288c0e168ab1c42ddceb0bfc57</param></service></servicedata> + <param name="changesrevision">f97866f7471cc5288c0e168ab1c42ddceb0bfc57</param></service><service name="tar_scm"> + <param name="url">https://github.com/kubeshark/kubeshark.git</param> + <param name="changesrevision">051f8805b6ad53820908872bea95f35482925e26</param></service></servicedata> (No newline at EOF) ++++++ kubeshark-cli-53.3.0.obscpio -> kubeshark-cli-53.4.0.obscpio ++++++ ++++ 3156 lines of diff (skipped) ++++++ kubeshark-cli.obsinfo ++++++ --- /var/tmp/diff_new_pack.SX817S/_old 2026-08-14 22:09:00.515374693 +0200 +++ /var/tmp/diff_new_pack.SX817S/_new 2026-08-14 22:09:00.522374940 +0200 @@ -1,5 +1,5 @@ name: kubeshark-cli -version: 53.3.0 -mtime: 1779181217 -commit: f97866f7471cc5288c0e168ab1c42ddceb0bfc57 +version: 53.4.0 +mtime: 1786645653 +commit: 051f8805b6ad53820908872bea95f35482925e26 ++++++ vendor.tar.gz ++++++ /work/SRC/openSUSE:Factory/kubeshark-cli/vendor.tar.gz /work/SRC/openSUSE:Factory/.kubeshark-cli.new.1258/vendor.tar.gz differ: char 14, line 1
