Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package bun for openSUSE:Factory checked in at 2026-08-18 16:37:39 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/bun (Old) and /work/SRC/openSUSE:Factory/.bun.new.1258 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "bun" Tue Aug 18 16:37:39 2026 rev:2 rq:1371686 version:1.4.0~git20260808.52bf09cb Changes: -------- --- /work/SRC/openSUSE:Factory/bun/bun.changes 2026-08-11 17:14:16.790785315 +0200 +++ /work/SRC/openSUSE:Factory/.bun.new.1258/bun.changes 2026-08-18 16:38:24.873077757 +0200 @@ -1,0 +2,13 @@ +Tue Aug 18 07:24:13 UTC 2026 - Martin Pluskal <[email protected]> + +- CVE-2026-73088: prototype pollution via unguarded for...in in + embedded browserslist normalizeStats() (boo#1275410) + * Prune Tools/WebKitBot from the WebKit source archive: Apple's + CI bot, a Node.js service never read by a JSCOnly build, whose + npm lockfile was the only place the vulnerable browserslist + 4.28.2 appeared - no browserslist code was ever compiled in + or shipped + * Extend the bun_webkit generator's prune list accordingly so + regenerated archives stay clean + +------------------------------------------------------------------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ README.SUSE-maint ++++++ --- /var/tmp/diff_new_pack.Vfs5gD/_old 2026-08-18 16:38:31.173303201 +0200 +++ /var/tmp/diff_new_pack.Vfs5gD/_new 2026-08-18 16:38:31.181303487 +0200 @@ -63,8 +63,20 @@ LayoutTests PerformanceTests WebDriverTests ManualTests test suites JSTests JSC's own tests Websites webkit.org content + Tools/WebKitBot Apple's CI bot -Together those are about five times the size of everything the build uses. +Together the test suites and website content are about five times the size of +everything the build uses. + +Tools/WebKitBot is pruned for a different reason: it is a Node.js service - +Apple's commit/CI bot - whose npm lockfile pins packages with published CVEs +(browserslist 4.28.2, CVE-2026-73088, boo#1275410), and security scanners +report anything named in a shipped lockfile as a package embedded in bun. No +code from it is built or shipped - nothing in a JSCOnly build reads Tools/ +beyond the build scripts - so dropping it removes the finding at the source. +The archive can be re-checked at any time with + + tar --zstd -tf webkit-*.tar.zst | grep -i browserslist The revision is read out of the Bun tarball and written to webkit.revision next to the archive, so a version bump cannot leave the engine behind. ++++++ bun_webkit ++++++ --- /var/tmp/diff_new_pack.Vfs5gD/_old 2026-08-18 16:38:31.470313829 +0200 +++ /var/tmp/diff_new_pack.Vfs5gD/_new 2026-08-18 16:38:31.481314223 +0200 @@ -17,10 +17,17 @@ # LayoutTests PerformanceTests WebDriverTests ManualTests test suites # JSTests JSC's own tests # Websites webkit.org content +# Tools/WebKitBot Apple's CI bot # # Together those are about five times the size of everything the build uses. # Nothing outside Source/ and Tools/ is referenced by the JSCOnly port. # +# Tools/WebKitBot is different from the rest of the list: it is dropped not +# for size but because it is a Node.js service whose npm lockfile pins +# packages with published CVEs (browserslist 4.28.2, CVE-2026-73088, +# boo#1275410), which security scanners report as packages embedded in bun. +# No code from it is built or shipped - nothing in a JSCOnly build reads it. +# # The pinned revision is read out of the Bun source tree, so a version bump # cannot leave the engine behind. # @@ -79,9 +86,10 @@ echo "$0: checked out revision does not match the pin" >&2; exit 1 } -echo "dropping test suites and website content" +echo "dropping test suites, website content and CI bot tooling" rm -rf "$src/.git" "$src/LayoutTests" "$src/JSTests" "$src/PerformanceTests" \ - "$src/WebDriverTests" "$src/ManualTests" "$src/Websites" + "$src/WebDriverTests" "$src/ManualTests" "$src/Websites" \ + "$src/Tools/WebKitBot" archive="webkit-$version.tar.zst" echo "packing $archive ($(du -sh "$src" | cut -f1))" ++++++ webkit-1.4.0~git20260808.52bf09cb.tar.zst ++++++ /work/SRC/openSUSE:Factory/bun/webkit-1.4.0~git20260808.52bf09cb.tar.zst /work/SRC/openSUSE:Factory/.bun.new.1258/webkit-1.4.0~git20260808.52bf09cb.tar.zst differ: char 215403598, line 864291
