Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package perl-Net-OAuth for openSUSE:Factory checked in at 2026-08-19 17:57:45 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/perl-Net-OAuth (Old) and /work/SRC/openSUSE:Factory/.perl-Net-OAuth.new.1258 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "perl-Net-OAuth" Wed Aug 19 17:57:45 2026 rev:12 rq:1372004 version:0.330.0 Changes: -------- --- /work/SRC/openSUSE:Factory/perl-Net-OAuth/perl-Net-OAuth.changes 2025-04-20 20:06:17.392888345 +0200 +++ /work/SRC/openSUSE:Factory/.perl-Net-OAuth.new.1258/perl-Net-OAuth.changes 2026-08-19 17:57:59.937304980 +0200 @@ -1,0 +2,40 @@ +Wed Aug 19 11:57:09 UTC 2026 - Tina Müller <[email protected]> + +- updated to 0.330.0 (0.33) + see /usr/share/doc/packages/perl-Net-OAuth/Changes + + 0.33 Mon 17 Aug 23:14:01 BST 2026 + [Security] + - Restrict the verification algorithm to those specified in the allowed_signature_methods, which is + now required. THIS IS A BREAKING CHANGE. + See https://github.com/vurtdev/Net-OAuth/security/advisories/GHSA-c8rm-g5cm-4pf5 (CVE-2026-72889) + for more information. + - HMAC_SHA1 and HMAC_SHA256 signature keys cannot be blank. + - HMAC_SHA1, HMAC_SHA256 and PLAINTEXT signature verification now use constant-time comparison (CVE-2026-75589). + bsc#1275651 + [Documentation] + - Updated the GitHub repository location, which moved before the version 0.32 release. + (The former location does redirect to the new location.) + - Removed CONTRIBUTING.md due to changes in the AI policy. + - Updated copyright year. + +------------------------------------------------------------------- +Sun Aug 16 05:43:13 UTC 2026 - Tina Müller <[email protected]> + +- updated to 0.320.0 (0.32) + see /usr/share/doc/packages/perl-Net-OAuth/Changes + + 0.32 Sun 16 Aug 00:51:04 BST 2026 + [Security] + - The Net::OAuth smart_require function no longer memoizes + failures, which allowed attackers to exhaust memory with + requests for invalid signature methods. CVE-2026-72888 + bsc#1275446 + + - Net::OAuth::Client no longer allows silent downgrades from + OAuth 1.0a to 1.0 when the remote provider drops the + oauth_verifier. The behavior can be re-enabled with the + allow_v1a_downgrade option. CVE-2026-72887 + bsc#1275447 + +------------------------------------------------------------------- Old: ---- Net-OAuth-0.31.tar.gz New: ---- Net-OAuth-0.33.tar.gz README.md _scmsync.obsinfo build.specials.obscpio ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ perl-Net-OAuth.spec ++++++ --- /var/tmp/diff_new_pack.CDDCXP/_old 2026-08-19 17:58:00.666331126 +0200 +++ /var/tmp/diff_new_pack.CDDCXP/_new 2026-08-19 17:58:00.667331162 +0200 @@ -1,7 +1,7 @@ # # spec file for package perl-Net-OAuth # -# Copyright (c) 2025 SUSE LLC +# Copyright (c) 2026 SUSE LLC and contributors # # All modifications and additions to the file contributed by third parties # remain the property of their copyright owners, unless otherwise agreed @@ -18,34 +18,35 @@ %define cpan_name Net-OAuth Name: perl-Net-OAuth -Version: 0.310.0 +Version: 0.330.0 Release: 0 -# 0.31 -> normalize -> 0.310.0 -%define cpan_version 0.31 +# 0.33 -> normalize -> 0.330.0 +%define cpan_version 0.33 License: Artistic-1.0 OR GPL-1.0-or-later Summary: OAuth 1.0 for Perl URL: https://metacpan.org/release/%{cpan_name} Source0: https://cpan.metacpan.org/authors/id/R/RR/RRWO/%{cpan_name}-%{cpan_version}.tar.gz +Source100: README.md BuildArch: noarch BuildRequires: perl BuildRequires: perl-macros -BuildRequires: perl(Class::Accessor) >= 0.31 -BuildRequires: perl(Class::Data::Inheritable) >= 0.60.0 -BuildRequires: perl(Crypt::URandom) >= 0.370 +BuildRequires: perl(Class::Accessor) >= 0.310 +BuildRequires: perl(Class::Data::Inheritable) >= 0.60 +BuildRequires: perl(Crypt::SysRandom) >= 0.6 BuildRequires: perl(Digest::SHA) >= 5.47 BuildRequires: perl(Encode) >= 2.35 BuildRequires: perl(LWP::UserAgent) >= 1 BuildRequires: perl(Test::More) >= 0.66 -BuildRequires: perl(Test::Warn) >= 0.21 +BuildRequires: perl(Test::Warn) >= 0.210 BuildRequires: perl(URI) >= 5.150 -Requires: perl(Class::Accessor) >= 0.31 -Requires: perl(Class::Data::Inheritable) >= 0.60.0 -Requires: perl(Crypt::URandom) >= 0.370 +Requires: perl(Class::Accessor) >= 0.310 +Requires: perl(Class::Data::Inheritable) >= 0.60 +Requires: perl(Crypt::SysRandom) >= 0.6 Requires: perl(Digest::SHA) >= 5.47 Requires: perl(Encode) >= 2.35 Requires: perl(LWP::UserAgent) >= 1 Requires: perl(Test::More) >= 0.66 -Requires: perl(Test::Warn) >= 0.21 +Requires: perl(Test::Warn) >= 0.210 Requires: perl(URI) >= 5.150 Provides: perl(Net::OAuth) = %{version} Provides: perl(Net::OAuth::AccessToken) @@ -59,6 +60,7 @@ Provides: perl(Net::OAuth::RequestTokenRequest) Provides: perl(Net::OAuth::RequestTokenResponse) Provides: perl(Net::OAuth::Response) +Provides: perl(Net::OAuth::SignatureMethod) Provides: perl(Net::OAuth::SignatureMethod::HMAC_SHA1) Provides: perl(Net::OAuth::SignatureMethod::HMAC_SHA256) Provides: perl(Net::OAuth::SignatureMethod::PLAINTEXT) @@ -72,6 +74,8 @@ Provides: perl(Net::OAuth::XauthAccessTokenRequest) Provides: perl(Net::OAuth::YahooAccessTokenRefreshRequest) %undefine __perllib_provides +Recommends: perl(Crypt::OpenSSL::RSA) >= 0.380 +Recommends: perl(Crypt::SysRandom::XS) >= 0.10 %{perl_requires} %description @@ -80,8 +84,6 @@ %prep %autosetup -n %{cpan_name}-%{cpan_version} -p1 -find . -type f ! -path "*/t/*" ! -name "*.pl" ! -path "*/bin/*" ! -path "*/script/*" ! -path "*/scripts/*" ! -name "configure" -print0 | xargs -0 chmod 644 - %build perl Makefile.PL INSTALLDIRS=vendor %make_build ++++++ Net-OAuth-0.31.tar.gz -> Net-OAuth-0.33.tar.gz ++++++ ++++ 2164 lines of diff (skipped) ++++++ README.md ++++++ ## Build Results Current state of perl in openSUSE:Factory is  The current state of perl in the devel project build (devel:languages:perl)  ++++++ _scmsync.obsinfo ++++++ mtime: 1787140784 commit: ec63755eb31449cdda521a96d6d8e6eb0bc156aa3c09b1c6d14de1af0e2757bb url: https://src.opensuse.org/perl/perl-Net-OAuth revision: ec63755eb31449cdda521a96d6d8e6eb0bc156aa3c09b1c6d14de1af0e2757bb projectscmsync: https://src.opensuse.org/perl/_ObsPrj ++++++ build.specials.obscpio ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/.gitignore new/.gitignore --- old/.gitignore 1970-01-01 01:00:00.000000000 +0100 +++ new/.gitignore 2026-08-19 13:59:44.000000000 +0200 @@ -0,0 +1 @@ +.osc
