Script 'mail_helper' called by obssrc
Hello community,

here is the log from the commit of package goose for openSUSE:Factory checked 
in at 2026-08-24 12:10:03
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/goose (Old)
 and      /work/SRC/openSUSE:Factory/.goose.new.1258 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Package is "goose"

Mon Aug 24 12:10:03 2026 rev:2 rq:1373122 version:1.47.0

Changes:
--------
--- /work/SRC/openSUSE:Factory/goose/goose.changes      2026-08-18 
16:37:20.787783322 +0200
+++ /work/SRC/openSUSE:Factory/.goose.new.1258/goose.changes    2026-08-24 
12:15:31.133315480 +0200
@@ -1,0 +2,33 @@
+Sat Aug 22 13:49:47 UTC 2026 - Martin Pluskal <[email protected]>
+
+- Update to version 1.47.0:
+  * recipes: the documented minijinja filters work again, and
+    recipe parameter values are validated before a run starts
+  * the computercontroller extension no longer offers the
+    automation_script, web_scrape and cache tools
+  * ACP: authentication errors are reported by the goose acp
+    server, large sessions no longer drop the connection, and the
+    handoff context is retried after a failed prompt
+  * providers: context-length-exceeded is recognised from byte-size
+    request limits as well, one-shot fast-model calls no longer pay
+    the prompt-cache write premium, and the Gemini OAuth provider
+    is deprecated
+  * extensions over streamable HTTP can use pre-registered OAuth
+    clients, and OAuth token transport must now be secure
+  * hardening: bounded XLSX range reads, local image reads,
+    action-required stream admission and partial thinking tags;
+    goose review no longer follows untracked symlinks
+  * the bundled SQLite is 3.51.3
+- Re-derive the License tag from the new vendored crate graph: the
+  set of 13 SPDX identifiers is unchanged, but BSD-2-Clause is now
+  carried only by the bundled leaflet.min.js because arrayref left
+  the crate graph
+- Drop the pkgconfig(sqlite3) BuildRequires: sqlx requests
+  libsqlite3-sys with the "bundled" feature, so SQLite is compiled
+  from the crate-bundled amalgamation and the system library is
+  never linked
+- Declare the C libraries that are statically compiled into the
+  binary as bundled() provides, so their CVE surface is visible:
+  aws-lc 5.5.0, libzstd 1.5.7, oniguruma 6.9.10 and sqlite3 3.51.3
+
+-------------------------------------------------------------------

Old:
----
  goose-1.46.0.tar.zst

New:
----
  goose-1.47.0.tar.zst

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Other differences:
------------------
++++++ goose.spec ++++++
--- /var/tmp/diff_new_pack.qFzc0E/_old  2026-08-24 12:15:42.616726948 +0200
+++ /var/tmp/diff_new_pack.qFzc0E/_new  2026-08-24 12:15:42.618727020 +0200
@@ -18,7 +18,7 @@
 
 %global goose_features 
aws-providers,nostr,otel,rustls-tls,system-keyring,tui,disable-update
 Name:           goose
-Version:        1.46.0
+Version:        1.47.0
 Release:        0
 Summary:        Extensible open source AI agent that automates engineering 
tasks
 # Legal-Review-Notice: goose itself is Apache-2.0, but the shipped binary
@@ -26,8 +26,9 @@
 # whole linked set. Derived on this vendoring with
 # "cargo tree --offline -p goose-cli -e normal --no-default-features
 #  --features %%{goose_features}" over the vendored tree
-# (1235 crates vendored, 608 in the linked graph -- the code-mode and
-# local-inference branches, and with them v8/candle/llama-cpp, are not built),
+# (1216 crates vendored, 607 in the linked graph -- the code-mode and
+# local-inference branches, and with them v8/candle/llama-cpp, are not built,
+# and neither is the cuda branch, so the cudaforge git dependency is unused),
 # then reading "license =" from every 
vendor-crates/<name>-<version>/Cargo.toml.
 # Where a crate offers a choice the Apache-2.0 branch is elected, and MIT where
 # Apache-2.0 is not on offer; both are already named, so no "OR" expression in
@@ -35,19 +36,22 @@
 # to make: LGPL-3.0-or-later from ansi_colours (pulled in by bat),
 # MPL-2.0 from option-ext (via dirs-sys), Unicode-3.0 from the 20 ICU crates,
 # CC0-1.0 from the five bitcoin_hashes/secp256k1 crates (nostr),
-# CDLA-Permissive-2.0 from webpki-roots, ISC from rustls-webpki and untrusted
-# (and from ring, "Apache-2.0 AND ISC"), BSD-3-Clause from subtle/brotli/
-# alloc-no-stdlib, BSD-2-Clause from arrayref, Zlib from foldhash and friends,
-# MIT-0 from borrow-or-share, bzip2-1.0.6 from libbz2-rs-sys, and MIT from the
-# 165 MIT-only crates. MPL-2.0 section 3.2 and the LGPL-3.0 source requirement
+# CDLA-Permissive-2.0 from the two webpki-roots, ISC from rustls-webpki,
+# simple_asn1 and untrusted (and from ring, "Apache-2.0 AND ISC"),
+# BSD-3-Clause from subtle/brotli/alloc-no-stdlib/exr/lebe, Zlib from foldhash
+# and zlib-rs, MIT-0 from borrow-or-share, bzip2-1.0.6 from libbz2-rs-sys, and
+# MIT from the 164 MIT-only crates. No crate in the graph carries BSD-2-Clause
+# any more (arrayref left it in 1.47.0); that identifier is now held solely by
+# the bundled leaflet.min.js named below.
+# MPL-2.0 section 3.2 and the LGPL-3.0 source requirement
 # are satisfied because the complete vendor-crates.tar.zst ships in the 
src.rpm;
 # the two texts are additionally installed as %%license files.
 # Beside the crates, goose-mcp include_str!()s six minified JavaScript/CSS
 # libraries into the binary -- chart.js (MIT), d3 (ISC), d3-sankey
 # (BSD-3-Clause), leaflet (BSD-2-Clause), leaflet.markercluster (MIT) and
-# mermaid (MIT). Every one of those identifiers is already carried above by a
-# Rust crate, so they add nothing to the tag; their texts, which upstream keeps
-# in crates/goose-mcp/licenses/, are installed as %%license files.
+# mermaid (MIT). All but leaflet's BSD-2-Clause are already carried above by a
+# Rust crate; their texts, which upstream keeps in crates/goose-mcp/licenses/,
+# are installed as %%license files.
 License:        Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND CC0-1.0 AND 
CDLA-Permissive-2.0 AND ISC AND LGPL-3.0-or-later AND MIT AND MIT-0 AND MPL-2.0 
AND Unicode-3.0 AND Zlib AND bzip2-1.0.6
 URL:            https://github.com/aaif-goose/goose
 Source0:        %{name}-%{version}.tar.zst
@@ -62,15 +66,24 @@
 # upstream declares rust-version = "1.94.1" in the workspace manifest and cargo
 # refuses to build below it
 BuildRequires:  rust >= 1.94.1
-# libdbus-sys (via keyring -> dbus-secret-service) probes for it
+# libdbus-sys (via keyring -> dbus-secret-service) probes for it; the floor is
+# the one its build script passes to pkg-config
 BuildRequires:  pkgconfig(dbus-1) >= 1.6
-# libsqlite3-sys is pulled in by sqlx-sqlite with default-features off, so it
-# links the system SQLite rather than the bundled copy
-BuildRequires:  pkgconfig(sqlite3)
 # The computer-controller extension shells out to these; goose warns at 
start-up
 # when none of them is present, but works without them.
 Recommends:     wtype
 Recommends:     xdotool
+# Four C libraries are compiled into the binary from crate-bundled sources and
+# cannot be unbundled without patching the feature selection upstream picked:
+# sqlx requests libsqlite3-sys with "bundled", so SQLite is the cc-compiled
+# amalgamation and NOT the system library; zstd-sys and onig_sys only use
+# pkg-config behind a feature/env switch neither sqlx nor bat sets; aws-lc-sys
+# (pulled in by rustls) has no system-library mode at all. Declare them so the
+# bundled CVE surface is visible to the distribution.
+Provides:       bundled(aws-lc) = 5.5.0
+Provides:       bundled(libzstd) = 1.5.7
+Provides:       bundled(oniguruma) = 6.9.10
+Provides:       bundled(sqlite3) = 3.51.3
 ExclusiveArch:  %{rust_tier1_arches}
 
 %description

++++++ _service ++++++
--- /var/tmp/diff_new_pack.qFzc0E/_old  2026-08-24 12:15:42.702730030 +0200
+++ /var/tmp/diff_new_pack.qFzc0E/_new  2026-08-24 12:15:42.707730209 +0200
@@ -2,7 +2,7 @@
   <service name="obs_scm" mode="manual">
     <param name="url">https://github.com/aaif-goose/goose.git</param>
     <param name="scm">git</param>
-    <param name="revision">v1.46.0</param>
+    <param name="revision">v1.47.0</param>
     <param name="match-tag">*</param>
     <param name="versionformat">@PARENT_TAG@</param>
     <param name="versionrewrite-pattern">v(\d+\.\d+\.\d+)</param>

++++++ goose-1.46.0.tar.zst -> goose-1.47.0.tar.zst ++++++
/work/SRC/openSUSE:Factory/goose/goose-1.46.0.tar.zst 
/work/SRC/openSUSE:Factory/.goose.new.1258/goose-1.47.0.tar.zst differ: char 7, 
line 1

++++++ vendor-crates.tar.zst ++++++
/work/SRC/openSUSE:Factory/goose/vendor-crates.tar.zst 
/work/SRC/openSUSE:Factory/.goose.new.1258/vendor-crates.tar.zst differ: char 
7, line 1

Reply via email to