Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package goshs for openSUSE:Factory checked in at 2026-09-04 12:38:47 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/goshs (Old) and /work/SRC/openSUSE:Factory/.goshs.new.1265 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "goshs" Fri Sep 4 12:38:47 2026 rev:16 rq:1375441 version:2.1.6 Changes: -------- --- /work/SRC/openSUSE:Factory/goshs/goshs.changes 2026-08-04 21:34:16.699855637 +0200 +++ /work/SRC/openSUSE:Factory/.goshs.new.1265/goshs.changes 2026-09-04 12:39:35.104846097 +0200 @@ -1,0 +2,64 @@ +Tue Sep 1 14:32:54 UTC 2026 - Martin Hauke <[email protected]> + +- Update to version 2.1.6 + New Features + * Team chat (replaces the shared clipboard) β The non-persistent + clipboard has grown into a live, collaboration-focused chat, + synchronized over the websocket hub across every browser and + the --tui dashboard (which authors as tui@<host>). + Highlights: + + Markdown rendering with the full :shortcode: emoji catalog + (~1800 emoji), composer autosuggest, and collapsible long + code blocks. + + Emoji reactions (with a who-reacted tooltip) and in-place + editing of your own messages (β in the composer recalls and + cycles them; edits are flagged (edited)). + + Image paste (inlined as base64, or written to disk with + --persist-chat-images) and file upload via π (POST + /?chatUpload β .goshs-chat/, respects --read-only, hidden + from the listing). + + Own-message highlight and opt-in desktop notifications + (π toggle) for others' messages when the tab is hidden. + + Opt-in persistence β --persist-chat writes the full log + (messages, edit flags, per-emoji reaction authors) to + <webroot>/.goshs-chat/chat.json and restores it on restart; + in memory only by default. + Security + * Content-destruction / mode-flag bypasses under --no-delete + / --upload-only / --read-only (#256) β Across every write + protocol, --no-delete/--upload-only now treat overwrite, + in-place write, truncate and rename/move of a pre-existing + file as deletion-class operations and refuse them, while + still allowing new-file creation and the operator's own + createβwriteβrename upload flow. + * SMB WRITE opcode overwrite (GHSA-275v-rxgc-4rcj, High) β the + SMB2 WRITE opcode ignored the flags, allowing in-place + overwrite of existing files. + * SMB overwrite disposition & SET_INFO truncate + (GHSA-jx6h-2x8x-hf5r, High) β + FILE_OVERWRITE/OVERWRITE_IF/SUPERSEDE creates and SET_INFO + allocation/EOF truncation destroyed existing file contents. + * SMB rename/clobber (GHSA-ppvh-3pc7-mvxw, High) β + FileRenameInformation moved and clobbered existing files. + * TFTP --no-delete ignored (GHSA-2q29-798w-6qcp, High) β a TFTP + WRQ ignored --no-delete, allowing overwrite and truncation of + existing files. + * TFTP WRQ destroys served files (GHSA-vw29-46p5-7h7x, High) + β an unauthenticated WRQ could truncate any served file + (os.Create implies O_TRUNC). + * HTTP DELETE on block-listed files (GHSA-ppmc-5w4w-2669, High) + β incomplete fix of CVE-2026-40189: .goshs block-listed files + could still be removed via HTTP DELETE; the block list is now + enforced before removal, mirroring the read/share/bulk/WebDAV + paths. + * WebDAV LOCK plants empty files (GHSA-whqg-vqcj-px54, Medium) + β the library's LOCK handler plants lock-null empty files for + absent paths, bypassing --read-only/--upload-only; webdavGuard + now refuses LOCK/UNLOCK in those modes. + Credential & ACL exposure (#234) + * Collaborator feed leaks the .goshs Authorization header + (GHSA-wfg4-m42q-9pvq, High). + * Block-only .goshs erases an ancestor's auth + (GHSA-cfhc-8j7j-54wq, High) + +------------------------------------------------------------------- Old: ---- goshs-2.1.5.tar.gz New: ---- goshs-2.1.6.tar.gz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ goshs.spec ++++++ --- /var/tmp/diff_new_pack.ZKMqEI/_old 2026-09-04 12:39:36.739903534 +0200 +++ /var/tmp/diff_new_pack.ZKMqEI/_new 2026-09-04 12:39:36.741903605 +0200 @@ -16,7 +16,7 @@ # Name: goshs -Version: 2.1.5 +Version: 2.1.6 Release: 0 Summary: A simple HTTP server License: MIT ++++++ goshs-2.1.5.tar.gz -> goshs-2.1.6.tar.gz ++++++ ++++ 6797 lines of diff (skipped) ++++++ vendor.tar.gz ++++++ /work/SRC/openSUSE:Factory/goshs/vendor.tar.gz /work/SRC/openSUSE:Factory/.goshs.new.1265/vendor.tar.gz differ: char 48, line 1
