Script 'mail_helper' called by obssrc
Hello community,
here is the log from the commit of package qt6-networkauth for openSUSE:Factory
checked in at 2026-08-21 16:50:55
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/qt6-networkauth (Old)
and /work/SRC/openSUSE:Factory/.qt6-networkauth.new.1258 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "qt6-networkauth"
Fri Aug 21 16:50:55 2026 rev:43 rq:1372249 version:6.11.2
Changes:
--------
--- /work/SRC/openSUSE:Factory/qt6-networkauth/qt6-networkauth.changes
2026-05-28 17:25:41.336613916 +0200
+++
/work/SRC/openSUSE:Factory/.qt6-networkauth.new.1258/qt6-networkauth.changes
2026-08-21 16:51:51.837861652 +0200
@@ -1,0 +2,6 @@
+Tue Aug 18 11:48:54 UTC 2026 - Christophe Marin <[email protected]>
+
+- Update to 6.11.2
+ https://www.qt.io/blog/qt-6.11.2-released
+
+-------------------------------------------------------------------
Old:
----
qtnetworkauth-everywhere-src-6.11.1.tar.xz
New:
----
qtnetworkauth-everywhere-src-6.11.2.tar.xz
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ qt6-networkauth.spec ++++++
--- /var/tmp/diff_new_pack.SJ1Ecl/_old 2026-08-21 16:51:52.656890776 +0200
+++ /var/tmp/diff_new_pack.SJ1Ecl/_new 2026-08-21 16:51:52.657890811 +0200
@@ -16,7 +16,7 @@
#
-%define real_version 6.11.1
+%define real_version 6.11.2
%define short_version 6.11
%define short_name qtnetworkauth
%define tar_name qtnetworkauth-everywhere-src
@@ -28,7 +28,7 @@
%endif
#
Name: qt6-networkauth%{?pkg_suffix}
-Version: 6.11.1
+Version: 6.11.2
Release: 0
Summary: Set of APIs to obtain limited access to online accounts and
HTTP services
License: GPL-3.0-only WITH Qt-GPL-exception-1.0
++++++ qtnetworkauth-everywhere-src-6.11.1.tar.xz ->
qtnetworkauth-everywhere-src-6.11.2.tar.xz ++++++
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/qtnetworkauth-everywhere-src-6.11.1/.cmake.conf
new/qtnetworkauth-everywhere-src-6.11.2/.cmake.conf
--- old/qtnetworkauth-everywhere-src-6.11.1/.cmake.conf 2026-05-07
21:59:28.000000000 +0200
+++ new/qtnetworkauth-everywhere-src-6.11.2/.cmake.conf 2026-08-11
19:38:11.000000000 +0200
@@ -1,4 +1,4 @@
-set(QT_REPO_MODULE_VERSION "6.11.1")
+set(QT_REPO_MODULE_VERSION "6.11.2")
set(QT_REPO_MODULE_PRERELEASE_VERSION_SEGMENT "alpha1")
set(QT_EXTRA_INTERNAL_TARGET_DEFINES
"QT_ENABLE_STRICT_MODE_UP_TO=QT_VERSION_CHECK(6,11,0)"
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/qtnetworkauth-everywhere-src-6.11.1/.tag
new/qtnetworkauth-everywhere-src-6.11.2/.tag
--- old/qtnetworkauth-everywhere-src-6.11.1/.tag 2026-05-07
21:59:28.000000000 +0200
+++ new/qtnetworkauth-everywhere-src-6.11.2/.tag 2026-08-11
19:38:11.000000000 +0200
@@ -1 +1 @@
-a804d2581006e827c8966b7514f98e0bfc599b02
+3dc4ab6bd5087fc2f799be67470f5789eb06633c
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore'
old/qtnetworkauth-everywhere-src-6.11.1/dependencies.yaml
new/qtnetworkauth-everywhere-src-6.11.2/dependencies.yaml
--- old/qtnetworkauth-everywhere-src-6.11.1/dependencies.yaml 2026-05-07
21:59:28.000000000 +0200
+++ new/qtnetworkauth-everywhere-src-6.11.2/dependencies.yaml 2026-08-11
19:38:11.000000000 +0200
@@ -1,4 +1,4 @@
dependencies:
../qtbase:
- ref: 59c81a3c2247b821b9b84b4eb8d939b77e07e276
+ ref: ef55f427f2c8b410d34f8a7681020a3000cf6866
required: true
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore'
old/qtnetworkauth-everywhere-src-6.11.1/src/oauth/qabstractoauth2.cpp
new/qtnetworkauth-everywhere-src-6.11.2/src/oauth/qabstractoauth2.cpp
--- old/qtnetworkauth-everywhere-src-6.11.1/src/oauth/qabstractoauth2.cpp
2026-05-07 21:59:28.000000000 +0200
+++ new/qtnetworkauth-everywhere-src-6.11.2/src/oauth/qabstractoauth2.cpp
2026-08-11 19:38:11.000000000 +0200
@@ -189,6 +189,7 @@
relevant to OIDC authentication flows.
\value Enabled Nonce is sent during authorization stage.
\value Disabled Nonce is not sent during authorization stage.
+ This disables OpenID Connect \c {id_token} replay protection.
\sa nonce, {OAuth 2.0 Overview}
*/
@@ -290,6 +291,15 @@
authentication. The state is used to identify and validate the
request when the callback is received.
+ If no state has been set when the authorization flow starts, a
+ random 32-character state is generated automatically. This is the
+ default and the recommended way.
+
+ This state is the primary protection against
+ \l {https://datatracker.ietf.org/doc/html/rfc6819#section-3.6}{cross-site
request forgery},
+ and should therefore contain a sufficient amount of
+ randomness. If you set it manually consider using at least 32 random
characters.
+
Certain characters are illegal in the state element (see
\l {https://datatracker.ietf.org/doc/html/rfc6749#appendix-A.5}{RFC 6749}).
The use of illegal characters could lead to an unintended state mismatch
@@ -551,7 +561,12 @@
QString QAbstractOAuth2Private::generateRandomState()
{
- return
QString::fromLatin1(QAbstractOAuthPrivate::generateRandomBase64String(8));
+ // There is no strict minimum or maximum size for state, but
+ // generating a 32-character base64 URL string provides
+ // ~192 bits of entropy (32 characters * 6 bits per character), which is
+ // a common minimum size and meets OAuth 2 recommendation for secrets:
+ // https://datatracker.ietf.org/doc/html/rfc6819#section-5.1.4.2.2
+ return
QString::fromLatin1(QAbstractOAuthPrivate::generateRandomBase64String(32));
}
QString QAbstractOAuth2Private::generateNonce()
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore'
old/qtnetworkauth-everywhere-src-6.11.1/src/oauth/qoauth2authorizationcodeflow.cpp
new/qtnetworkauth-everywhere-src-6.11.2/src/oauth/qoauth2authorizationcodeflow.cpp
---
old/qtnetworkauth-everywhere-src-6.11.1/src/oauth/qoauth2authorizationcodeflow.cpp
2026-05-07 21:59:28.000000000 +0200
+++
new/qtnetworkauth-everywhere-src-6.11.2/src/oauth/qoauth2authorizationcodeflow.cpp
2026-08-11 19:38:11.000000000 +0200
@@ -299,12 +299,15 @@
originates from the same entity that issued the authorization
request.
- \value None PKCE is not used.
+ \value None PKCE is not used. This leaves the flow unprotected against
+ authorization code interception. Use this only if the authorization
+ server does not tolerate PKCE.
\value Plain The Plain PKCE method is used. Use this only if it is not
possible to use S256. With Plain method the
\l {https://datatracker.ietf.org/doc/html/rfc7636#section-4.2}{code
challenge}
equals to the
- \l {https://datatracker.ietf.org/doc/html/rfc7636#section-4.1}{code
verifier}.
+ \l {https://datatracker.ietf.org/doc/html/rfc7636#section-4.1}{code
verifier},
+ exposing the verifier to anyone able to intercept the authorization
request.
\value S256 The S256 PKCE method is used. This is the default and the
recommended method for native applications. With the S256 method
the \e {code challenge} is a base64url-encoded value of the
@@ -322,6 +325,10 @@
of the \c code_verifier. The value must be between 43 and 128 bytes.
The 'code verifier' itself is random-generated by the library.
+ Setting \a method to \l {PkceMethod}{PkceMethod::None} or
+ \l {PkceMethod}{PkceMethod::Plain} weakens the protection against
+ authorization code interception.
+
\sa pkceMethod(), QOAuth2AuthorizationCodeFlow::PkceMethod
*/
void QOAuth2AuthorizationCodeFlow::setPkceMethod(PkceMethod method, qsizetype
length)
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore'
old/qtnetworkauth-everywhere-src-6.11.1/src/oauth/qoauthhttpserverreplyhandler.cpp
new/qtnetworkauth-everywhere-src-6.11.2/src/oauth/qoauthhttpserverreplyhandler.cpp
---
old/qtnetworkauth-everywhere-src-6.11.1/src/oauth/qoauthhttpserverreplyhandler.cpp
2026-05-07 21:59:28.000000000 +0200
+++
new/qtnetworkauth-everywhere-src-6.11.2/src/oauth/qoauthhttpserverreplyhandler.cpp
2026-08-11 19:38:11.000000000 +0200
@@ -230,7 +230,7 @@
{
Q_Q(QOAuthHttpServerReplyHandler);
if (url.path() != path) {
- qCWarning(lcReplyHandler, "Invalid request: %s",
qPrintable(url.toString()));
+ qCWarning(lcReplyHandler, "Invalid request: URL path doesn't match");
} else {
Q_EMIT
q->callbackDataReceived(QUrl(callback()).resolved(url).toEncoded());
@@ -340,7 +340,7 @@
if (!fragment.startsWith(u'/') || !url.isValid() ||
!url.scheme().isNull()
|| !url.host().isNull()) {
- qCWarning(lcReplyHandler, "Invalid request: %s",
fragment.constData());
+ qCWarning(lcReplyHandler, "Invalid request: invalid
request-target");
return false;
}
fragment.clear();
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore'
old/qtnetworkauth-everywhere-src-6.11.1/tests/auto/oauth2codeflow/tst_oauth2codeflow.cpp
new/qtnetworkauth-everywhere-src-6.11.2/tests/auto/oauth2codeflow/tst_oauth2codeflow.cpp
---
old/qtnetworkauth-everywhere-src-6.11.1/tests/auto/oauth2codeflow/tst_oauth2codeflow.cpp
2026-05-07 21:59:28.000000000 +0200
+++
new/qtnetworkauth-everywhere-src-6.11.2/tests/auto/oauth2codeflow/tst_oauth2codeflow.cpp
2026-08-11 19:38:11.000000000 +0200
@@ -135,6 +135,7 @@
oauth2.grant();
QVERIFY(!stateParameter.isEmpty()); // internally generated initial state
used
QCOMPARE(stateParameter, oauth2.state());
+ QCOMPARE(stateParameter.size(), 32);
// Test setting the 'state' property
const QString simpleState = u"a_state"_s;
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore'
old/qtnetworkauth-everywhere-src-6.11.1/tests/auto/oauthhttpserverreplyhandler/tst_oauthhttpserverreplyhandler.cpp
new/qtnetworkauth-everywhere-src-6.11.2/tests/auto/oauthhttpserverreplyhandler/tst_oauthhttpserverreplyhandler.cpp
---
old/qtnetworkauth-everywhere-src-6.11.1/tests/auto/oauthhttpserverreplyhandler/tst_oauthhttpserverreplyhandler.cpp
2026-05-07 21:59:28.000000000 +0200
+++
new/qtnetworkauth-everywhere-src-6.11.2/tests/auto/oauthhttpserverreplyhandler/tst_oauthhttpserverreplyhandler.cpp
2026-08-11 19:38:11.000000000 +0200
@@ -281,10 +281,8 @@
&QTestEventLoop::exitLoop);
if (!success) {
- QByteArray httpUri = callback.toEncoded(QUrl::RemoveScheme |
QUrl::RemoveAuthority | QUrl::RemoveFragment);
- const QByteArray msg = "Invalid request: " + httpUri;
for (int i = 0; i < 2; ++i) // emitted more than once
- QTest::ignoreMessage(QtWarningMsg, msg.data());
+ QTest::ignoreMessage(QtWarningMsg, "Invalid request: URL path
doesn't match");
}
QTestEventLoop::instance().enterLoop(Timeout);
QCOMPARE(count > 0, success);
@@ -386,8 +384,7 @@
connect(&socket, &QTcpSocket::disconnected, &QTestEventLoop::instance(),
&QTestEventLoop::exitLoop);
- QTest::ignoreMessage(QtWarningMsg,
- QByteArray{"Invalid request: " +
uri.toLocal8Bit()}.constData());
+ QTest::ignoreMessage(QtWarningMsg, "Invalid request: invalid
request-target");
QTest::ignoreMessage(QtWarningMsg, "Invalid URL");
QTestEventLoop::instance().enterLoop(Timeout);
