Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package gh for openSUSE:Factory checked in at 2026-08-17 16:59:19 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/gh (Old) and /work/SRC/openSUSE:Factory/.gh.new.1258 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "gh" Mon Aug 17 16:59:19 2026 rev:100 rq:1371513 version:2.97.0 Changes: -------- --- /work/SRC/openSUSE:Factory/gh/gh.changes 2026-07-21 22:59:55.000722688 +0200 +++ /work/SRC/openSUSE:Factory/.gh.new.1258/gh.changes 2026-08-17 17:02:42.752917682 +0200 @@ -1,0 +2,22 @@ +Mon Aug 17 06:31:33 UTC 2026 - Pavel Dostál <[email protected]> + +- Update to version 2.97.0, fixing four security issues (CVE-2026-64654, + CVE-2026-64653, CVE-2026-64652, CVE-2026-64655): + * CVE-2026-64654: terminal escape sequence injection in gist view, api, + pr diff, release download --output -, codespace logs, skills preview + and agent-task view/create + * CVE-2026-64653: unescaped variable path components in request URLs + could redirect gh to a different resource than intended + * CVE-2026-64652: gh auth status could print part of the auth token in + plaintext for token types with an underscore after the prefix + * CVE-2026-64655: gh attestation verify built its --signer-repo/ + --signer-workflow matcher without escaping regex metacharacters, + allowing a lookalike signer to pass verification + * Add named field columns to gh project item-list and item-edit +- Verified gh-CVE-2026-39821-idna-punycode.patch is still required: gh + 2.97.0 still vendors golang.org/x/net v0.56.0 (the unicode16 gate is + only removed unconditionally in x/net >= v0.57.0), and Factory's go + package is still 1.26, whose unicode.Version stays 15.0.0 (the gate + only flips true at go1.27). Keep the patch until either lands. + +------------------------------------------------------------------- Old: ---- cli-2.96.0.tar.zst New: ---- cli-2.97.0.tar.zst ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ gh.spec ++++++ --- /var/tmp/diff_new_pack.dFP2rU/_old 2026-08-17 17:02:44.733987677 +0200 +++ /var/tmp/diff_new_pack.dFP2rU/_new 2026-08-17 17:02:44.738987854 +0200 @@ -20,7 +20,7 @@ %define goflags "-buildmode=pie -trimpath -mod=vendor -modcacherw" %define sname cli Name: gh -Version: 2.96.0 +Version: 2.97.0 Release: 0 Summary: The official CLI for GitHub License: MIT ++++++ _service ++++++ --- /var/tmp/diff_new_pack.dFP2rU/_old 2026-08-17 17:02:44.841991494 +0200 +++ /var/tmp/diff_new_pack.dFP2rU/_new 2026-08-17 17:02:44.854991953 +0200 @@ -3,7 +3,7 @@ <param name="url">https://github.com/cli/cli</param> <param name="scm">git</param> <param name="exclude">.git</param> - <param name="revision">v2.96.0</param> + <param name="revision">v2.97.0</param> <param name="versionformat">@PARENT_TAG@</param> <param name="changesgenerate">enable</param> <param name="versionrewrite-pattern">v(.*)</param> @@ -16,7 +16,7 @@ <param name="compression">zst</param> </service> <service name="go_modules" mode="manual"> - <param name="archive">cli-2.96.0.tar.zst</param> + <param name="archive">cli-2.97.0.tar.zst</param> </service> </services> ++++++ _servicedata ++++++ --- /var/tmp/diff_new_pack.dFP2rU/_old 2026-08-17 17:02:44.908993861 +0200 +++ /var/tmp/diff_new_pack.dFP2rU/_new 2026-08-17 17:02:44.918994214 +0200 @@ -1,7 +1,7 @@ <servicedata> <service name="tar_scm"> <param name="url">https://github.com/cli/cli</param> - <param name="changesrevision">b300f2ec7ec9dc9addc39b2ad88c54097ded7ca0</param> + <param name="changesrevision">55dbb4dc6b7edb10b48e3d7fc5bccd32318d1b55</param> </service> </servicedata> (No newline at EOF) ++++++ cli-2.96.0.tar.zst -> cli-2.97.0.tar.zst ++++++ /work/SRC/openSUSE:Factory/gh/cli-2.96.0.tar.zst /work/SRC/openSUSE:Factory/.gh.new.1258/cli-2.97.0.tar.zst differ: char 7, line 1 ++++++ vendor.tar.gz ++++++ /work/SRC/openSUSE:Factory/gh/vendor.tar.gz /work/SRC/openSUSE:Factory/.gh.new.1258/vendor.tar.gz differ: char 13, line 1
