Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package opentofu for openSUSE:Factory checked in at 2026-08-28 19:52:14 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/opentofu (Old) and /work/SRC/openSUSE:Factory/.opentofu.new.1265 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "opentofu" Fri Aug 28 19:52:14 2026 rev:54 rq:1374261 version:1.12.6 Changes: -------- --- /work/SRC/openSUSE:Factory/opentofu/opentofu.changes 2026-07-21 23:12:23.590385681 +0200 +++ /work/SRC/openSUSE:Factory/.opentofu.new.1265/opentofu.changes 2026-08-28 19:54:41.223296155 +0200 @@ -1,0 +2,17 @@ +Fri Aug 28 07:25:03 UTC 2026 - Johannes Kastl <[email protected]> + +- Update to version 1.12.6: + * SECURITY ADVISORIES: + - When interacting with OCI Distribution registries for module + or provider package installation, earlier versions of + OpenTofu could incorrectly resend credentials intended for + the original origin to the target of an HTTP redirect. + (#4422) + - When interacting with an attacker-controlled remote state + backend or provider/module registry, tofu init in earlier + versions of OpenTofu could potentially cause high CPU usage + and/or high memory usage resolving crafted relative URLs in + the API responses. (#4472) + - go.mod: go get oras.land/oras-go/[email protected] + +------------------------------------------------------------------- Old: ---- opentofu-1.12.5.obscpio New: ---- opentofu-1.12.6.obscpio ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ opentofu.spec ++++++ --- /var/tmp/diff_new_pack.1cAyPU/_old 2026-08-28 19:54:43.975392352 +0200 +++ /var/tmp/diff_new_pack.1cAyPU/_new 2026-08-28 19:54:43.979392491 +0200 @@ -19,7 +19,7 @@ %define executable_name tofu Name: opentofu -Version: 1.12.5 +Version: 1.12.6 Release: 0 Summary: Declaratively manage your cloud infrastructure License: MPL-2.0 @@ -29,7 +29,7 @@ Source1: vendor.tar.gz Source99: opentofu-rpmlintrc BuildRequires: bash-completion -BuildRequires: go1.26 >= 1.26.4 +BuildRequires: go1.26 >= 1.26.6 BuildRequires: golang-packaging # See: https://github.com/hashicorp/opentofu/issues/22807 ExcludeArch: %{ix86} %{arm} ++++++ _service ++++++ --- /var/tmp/diff_new_pack.1cAyPU/_old 2026-08-28 19:54:44.059395288 +0200 +++ /var/tmp/diff_new_pack.1cAyPU/_new 2026-08-28 19:54:44.064395463 +0200 @@ -3,7 +3,7 @@ <param name="url">https://github.com/opentofu/opentofu.git</param> <param name="scm">git</param> <param name="exclude">.git</param> - <param name="revision">refs/tags/v1.12.5</param> + <param name="revision">refs/tags/v1.12.6</param> <param name="versionformat">@PARENT_TAG@</param> <param name="versionrewrite-pattern">v(.*)</param> <param name="changesgenerate">enable</param> ++++++ _servicedata ++++++ --- /var/tmp/diff_new_pack.1cAyPU/_old 2026-08-28 19:54:44.115397245 +0200 +++ /var/tmp/diff_new_pack.1cAyPU/_new 2026-08-28 19:54:44.120397420 +0200 @@ -3,6 +3,6 @@ <param name="url">https://github.com/opentofu/opentofu/</param> <param name="changesrevision">bdcbf091aab886499ed7718d7f558b428fffce39</param></service><service name="tar_scm"> <param name="url">https://github.com/opentofu/opentofu.git</param> - <param name="changesrevision">230349e959a44fb8eb7b83754f9d9b012f3bdb42</param></service></servicedata> + <param name="changesrevision">b4305e5a5dd2fb79a27897ae30784a181d3a26cb</param></service></servicedata> (No newline at EOF) ++++++ opentofu-1.12.5.obscpio -> opentofu-1.12.6.obscpio ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/opentofu-1.12.5/CHANGELOG.md new/opentofu-1.12.6/CHANGELOG.md --- old/opentofu-1.12.5/CHANGELOG.md 2026-07-21 12:31:31.000000000 +0200 +++ new/opentofu-1.12.6/CHANGELOG.md 2026-08-19 12:04:04.000000000 +0200 @@ -1,6 +1,13 @@ The v1.12.x release series is supported until **February 1 2027**. -## 1.12.6 (unreleased) +## 1.12.7 (unreleased) + +## 1.12.6 + +SECURITY ADVISORIES: + +- When interacting with OCI Distribution registries for module or provider package installation, earlier versions of OpenTofu could incorrectly resend credentials intended for the original origin to the target of an HTTP redirect. ([#4422](https://github.com/opentofu/opentofu/pull/4422)) +- When interacting with an attacker-controlled remote state backend or provider/module registry, `tofu init` in earlier versions of OpenTofu could potentially cause high CPU usage and/or high memory usage resolving crafted relative URLs in the API responses. ([#4472](https://github.com/opentofu/opentofu/pull/4472)) ## 1.12.5 diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/opentofu-1.12.5/go.mod new/opentofu-1.12.6/go.mod --- old/opentofu-1.12.5/go.mod 2026-07-21 12:31:31.000000000 +0200 +++ new/opentofu-1.12.6/go.mod 2026-08-19 12:04:04.000000000 +0200 @@ -1,6 +1,6 @@ module github.com/opentofu/opentofu -go 1.26.5 +go 1.26.6 // At the time of adding this configuration, the new Go feature introduced here https://github.com/golang/go/issues/67061, // was having a good amount of issues linked to, affecting AWS Firewall, GCP various services and a lot more. @@ -117,7 +117,7 @@ k8s.io/apimachinery v0.35.2 k8s.io/client-go v0.35.2 k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2 - oras.land/oras-go/v2 v2.6.0 + oras.land/oras-go/v2 v2.6.1 ) require ( diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/opentofu-1.12.5/go.sum new/opentofu-1.12.6/go.sum --- old/opentofu-1.12.5/go.sum 2026-07-21 12:31:31.000000000 +0200 +++ new/opentofu-1.12.6/go.sum 2026-08-19 12:04:04.000000000 +0200 @@ -1176,8 +1176,8 @@ k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912/go.mod h1:kdmbQkyfwUagLfXIad1y2TdrjPFWp2Q89B3qkRwf/pQ= k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2 h1:AZYQSJemyQB5eRxqcPky+/7EdBj0xi3g0ZcxxJ7vbWU= k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2/go.mod h1:xDxuJ0whA3d0I4mf/C4ppKHxXynQ+fxnkmQH0vTHnuk= -oras.land/oras-go/v2 v2.6.0 h1:X4ELRsiGkrbeox69+9tzTu492FMUu7zJQW6eJU+I2oc= -oras.land/oras-go/v2 v2.6.0/go.mod h1:magiQDfG6H1O9APp+rOsvCPcW1GD2MM7vgnKY0Y+u1o= +oras.land/oras-go/v2 v2.6.1 h1:bonOEkjLfp8tt6qXWRRWP6p1F+9octchOf2EqnWB4Zs= +oras.land/oras-go/v2 v2.6.1/go.mod h1:dhtFrFOuZuDtAVeZ9FUnaa5zfzplG3ZnFX9/uH1J/Yk= rsc.io/pdf v0.1.1/go.mod h1:n8OzWcQ6Sp37PL01nO98y4iUCRdTGarVfzxY20ICaU4= sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 h1:IpInykpT6ceI+QxKBbEflcR5EXP7sU1kvOlxwZh5txg= sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730/go.mod h1:mdzfpAEoE6DHQEN0uh9ZbOCuHbLK5wOm7dK4ctXE9Tg= diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/opentofu-1.12.5/version/VERSION new/opentofu-1.12.6/version/VERSION --- old/opentofu-1.12.5/version/VERSION 2026-07-21 12:31:31.000000000 +0200 +++ new/opentofu-1.12.6/version/VERSION 2026-08-19 12:04:04.000000000 +0200 @@ -1 +1 @@ -1.12.5 +1.12.6 ++++++ opentofu.obsinfo ++++++ --- /var/tmp/diff_new_pack.1cAyPU/_old 2026-08-28 19:54:48.121537275 +0200 +++ /var/tmp/diff_new_pack.1cAyPU/_new 2026-08-28 19:54:48.134537730 +0200 @@ -1,5 +1,5 @@ name: opentofu -version: 1.12.5 -mtime: 1784629891 -commit: 230349e959a44fb8eb7b83754f9d9b012f3bdb42 +version: 1.12.6 +mtime: 1787133844 +commit: b4305e5a5dd2fb79a27897ae30784a181d3a26cb ++++++ vendor.tar.gz ++++++ /work/SRC/openSUSE:Factory/opentofu/vendor.tar.gz /work/SRC/openSUSE:Factory/.opentofu.new.1265/vendor.tar.gz differ: char 133, line 1
