Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package goose for openSUSE:Factory checked in at 2026-08-24 12:10:03 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/goose (Old) and /work/SRC/openSUSE:Factory/.goose.new.1258 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "goose" Mon Aug 24 12:10:03 2026 rev:2 rq:1373122 version:1.47.0 Changes: -------- --- /work/SRC/openSUSE:Factory/goose/goose.changes 2026-08-18 16:37:20.787783322 +0200 +++ /work/SRC/openSUSE:Factory/.goose.new.1258/goose.changes 2026-08-24 12:15:31.133315480 +0200 @@ -1,0 +2,33 @@ +Sat Aug 22 13:49:47 UTC 2026 - Martin Pluskal <[email protected]> + +- Update to version 1.47.0: + * recipes: the documented minijinja filters work again, and + recipe parameter values are validated before a run starts + * the computercontroller extension no longer offers the + automation_script, web_scrape and cache tools + * ACP: authentication errors are reported by the goose acp + server, large sessions no longer drop the connection, and the + handoff context is retried after a failed prompt + * providers: context-length-exceeded is recognised from byte-size + request limits as well, one-shot fast-model calls no longer pay + the prompt-cache write premium, and the Gemini OAuth provider + is deprecated + * extensions over streamable HTTP can use pre-registered OAuth + clients, and OAuth token transport must now be secure + * hardening: bounded XLSX range reads, local image reads, + action-required stream admission and partial thinking tags; + goose review no longer follows untracked symlinks + * the bundled SQLite is 3.51.3 +- Re-derive the License tag from the new vendored crate graph: the + set of 13 SPDX identifiers is unchanged, but BSD-2-Clause is now + carried only by the bundled leaflet.min.js because arrayref left + the crate graph +- Drop the pkgconfig(sqlite3) BuildRequires: sqlx requests + libsqlite3-sys with the "bundled" feature, so SQLite is compiled + from the crate-bundled amalgamation and the system library is + never linked +- Declare the C libraries that are statically compiled into the + binary as bundled() provides, so their CVE surface is visible: + aws-lc 5.5.0, libzstd 1.5.7, oniguruma 6.9.10 and sqlite3 3.51.3 + +------------------------------------------------------------------- Old: ---- goose-1.46.0.tar.zst New: ---- goose-1.47.0.tar.zst ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ goose.spec ++++++ --- /var/tmp/diff_new_pack.qFzc0E/_old 2026-08-24 12:15:42.616726948 +0200 +++ /var/tmp/diff_new_pack.qFzc0E/_new 2026-08-24 12:15:42.618727020 +0200 @@ -18,7 +18,7 @@ %global goose_features aws-providers,nostr,otel,rustls-tls,system-keyring,tui,disable-update Name: goose -Version: 1.46.0 +Version: 1.47.0 Release: 0 Summary: Extensible open source AI agent that automates engineering tasks # Legal-Review-Notice: goose itself is Apache-2.0, but the shipped binary @@ -26,8 +26,9 @@ # whole linked set. Derived on this vendoring with # "cargo tree --offline -p goose-cli -e normal --no-default-features # --features %%{goose_features}" over the vendored tree -# (1235 crates vendored, 608 in the linked graph -- the code-mode and -# local-inference branches, and with them v8/candle/llama-cpp, are not built), +# (1216 crates vendored, 607 in the linked graph -- the code-mode and +# local-inference branches, and with them v8/candle/llama-cpp, are not built, +# and neither is the cuda branch, so the cudaforge git dependency is unused), # then reading "license =" from every vendor-crates/<name>-<version>/Cargo.toml. # Where a crate offers a choice the Apache-2.0 branch is elected, and MIT where # Apache-2.0 is not on offer; both are already named, so no "OR" expression in @@ -35,19 +36,22 @@ # to make: LGPL-3.0-or-later from ansi_colours (pulled in by bat), # MPL-2.0 from option-ext (via dirs-sys), Unicode-3.0 from the 20 ICU crates, # CC0-1.0 from the five bitcoin_hashes/secp256k1 crates (nostr), -# CDLA-Permissive-2.0 from webpki-roots, ISC from rustls-webpki and untrusted -# (and from ring, "Apache-2.0 AND ISC"), BSD-3-Clause from subtle/brotli/ -# alloc-no-stdlib, BSD-2-Clause from arrayref, Zlib from foldhash and friends, -# MIT-0 from borrow-or-share, bzip2-1.0.6 from libbz2-rs-sys, and MIT from the -# 165 MIT-only crates. MPL-2.0 section 3.2 and the LGPL-3.0 source requirement +# CDLA-Permissive-2.0 from the two webpki-roots, ISC from rustls-webpki, +# simple_asn1 and untrusted (and from ring, "Apache-2.0 AND ISC"), +# BSD-3-Clause from subtle/brotli/alloc-no-stdlib/exr/lebe, Zlib from foldhash +# and zlib-rs, MIT-0 from borrow-or-share, bzip2-1.0.6 from libbz2-rs-sys, and +# MIT from the 164 MIT-only crates. No crate in the graph carries BSD-2-Clause +# any more (arrayref left it in 1.47.0); that identifier is now held solely by +# the bundled leaflet.min.js named below. +# MPL-2.0 section 3.2 and the LGPL-3.0 source requirement # are satisfied because the complete vendor-crates.tar.zst ships in the src.rpm; # the two texts are additionally installed as %%license files. # Beside the crates, goose-mcp include_str!()s six minified JavaScript/CSS # libraries into the binary -- chart.js (MIT), d3 (ISC), d3-sankey # (BSD-3-Clause), leaflet (BSD-2-Clause), leaflet.markercluster (MIT) and -# mermaid (MIT). Every one of those identifiers is already carried above by a -# Rust crate, so they add nothing to the tag; their texts, which upstream keeps -# in crates/goose-mcp/licenses/, are installed as %%license files. +# mermaid (MIT). All but leaflet's BSD-2-Clause are already carried above by a +# Rust crate; their texts, which upstream keeps in crates/goose-mcp/licenses/, +# are installed as %%license files. License: Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND CC0-1.0 AND CDLA-Permissive-2.0 AND ISC AND LGPL-3.0-or-later AND MIT AND MIT-0 AND MPL-2.0 AND Unicode-3.0 AND Zlib AND bzip2-1.0.6 URL: https://github.com/aaif-goose/goose Source0: %{name}-%{version}.tar.zst @@ -62,15 +66,24 @@ # upstream declares rust-version = "1.94.1" in the workspace manifest and cargo # refuses to build below it BuildRequires: rust >= 1.94.1 -# libdbus-sys (via keyring -> dbus-secret-service) probes for it +# libdbus-sys (via keyring -> dbus-secret-service) probes for it; the floor is +# the one its build script passes to pkg-config BuildRequires: pkgconfig(dbus-1) >= 1.6 -# libsqlite3-sys is pulled in by sqlx-sqlite with default-features off, so it -# links the system SQLite rather than the bundled copy -BuildRequires: pkgconfig(sqlite3) # The computer-controller extension shells out to these; goose warns at start-up # when none of them is present, but works without them. Recommends: wtype Recommends: xdotool +# Four C libraries are compiled into the binary from crate-bundled sources and +# cannot be unbundled without patching the feature selection upstream picked: +# sqlx requests libsqlite3-sys with "bundled", so SQLite is the cc-compiled +# amalgamation and NOT the system library; zstd-sys and onig_sys only use +# pkg-config behind a feature/env switch neither sqlx nor bat sets; aws-lc-sys +# (pulled in by rustls) has no system-library mode at all. Declare them so the +# bundled CVE surface is visible to the distribution. +Provides: bundled(aws-lc) = 5.5.0 +Provides: bundled(libzstd) = 1.5.7 +Provides: bundled(oniguruma) = 6.9.10 +Provides: bundled(sqlite3) = 3.51.3 ExclusiveArch: %{rust_tier1_arches} %description ++++++ _service ++++++ --- /var/tmp/diff_new_pack.qFzc0E/_old 2026-08-24 12:15:42.702730030 +0200 +++ /var/tmp/diff_new_pack.qFzc0E/_new 2026-08-24 12:15:42.707730209 +0200 @@ -2,7 +2,7 @@ <service name="obs_scm" mode="manual"> <param name="url">https://github.com/aaif-goose/goose.git</param> <param name="scm">git</param> - <param name="revision">v1.46.0</param> + <param name="revision">v1.47.0</param> <param name="match-tag">*</param> <param name="versionformat">@PARENT_TAG@</param> <param name="versionrewrite-pattern">v(\d+\.\d+\.\d+)</param> ++++++ goose-1.46.0.tar.zst -> goose-1.47.0.tar.zst ++++++ /work/SRC/openSUSE:Factory/goose/goose-1.46.0.tar.zst /work/SRC/openSUSE:Factory/.goose.new.1258/goose-1.47.0.tar.zst differ: char 7, line 1 ++++++ vendor-crates.tar.zst ++++++ /work/SRC/openSUSE:Factory/goose/vendor-crates.tar.zst /work/SRC/openSUSE:Factory/.goose.new.1258/vendor-crates.tar.zst differ: char 7, line 1
