Script 'mail_helper' called by obssrc
Hello community,
here is the log from the commit of package python-jwcrypto for openSUSE:Factory
checked in at 2026-09-07 11:29:39
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/python-jwcrypto (Old)
and /work/SRC/openSUSE:Factory/.python-jwcrypto.new.1265 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "python-jwcrypto"
Mon Sep 7 11:29:39 2026 rev:21 rq:1375754 version:1.6.0
Changes:
--------
--- /work/SRC/openSUSE:Factory/python-jwcrypto/python-jwcrypto.changes
2026-06-29 17:29:53.261057622 +0200
+++
/work/SRC/openSUSE:Factory/.python-jwcrypto.new.1265/python-jwcrypto.changes
2026-09-07 11:30:37.209710846 +0200
@@ -1,0 +2,14 @@
+Tue Sep 1 14:51:22 UTC 2026 - Nico Krapp <[email protected]>
+
+- Update to 1.6.0 (fixes CVE-2026-84185 (bsc#1278707)):
+ * Fix an issue with parsing headers with 'kid' by @simo5 in #395
+ * Version 1.6.0 by @simo5 in #396
+- Update to 1.5.9 (fixes CVE-2026-80179 (bsc#1277639):
+ * Add ML-DSA post-quantum signature support (RFC 9964) by @rjeffman in #384
+ * Support fully specified algorithms per RFC 9864 by @rjeffman in #389
+ * Skip unknown kty in JWKSet import per RFC 7517 ยง5 by @rjeffman in #388
+ * Reject non-empty encrypted key in bare ECDH-ES by @simo5 in #391
+ * Limit dot splits during JWE and JWS parsing by @simo5 in #392
+ * Version 1.5.9 by @simo5 in #393
+
+-------------------------------------------------------------------
Old:
----
jwcrypto-1.5.8.tar.gz
New:
----
jwcrypto-1.6.0.tar.gz
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ python-jwcrypto.spec ++++++
--- /var/tmp/diff_new_pack.dwokFI/_old 2026-09-07 11:30:38.243747089 +0200
+++ /var/tmp/diff_new_pack.dwokFI/_new 2026-09-07 11:30:38.244747124 +0200
@@ -18,7 +18,7 @@
%{?sle15_python_module_pythons}
Name: python-jwcrypto
-Version: 1.5.8
+Version: 1.6.0
Release: 0
Summary: Python module package implementing JOSE Web standards
License: LGPL-3.0-only
++++++ jwcrypto-1.5.8.tar.gz -> jwcrypto-1.6.0.tar.gz ++++++
++++ 1672 lines of diff (skipped)
