Script 'mail_helper' called by obssrc
Hello community,
here is the log from the commit of package perl-Protocol-HTTP2 for
openSUSE:Factory checked in at 2026-09-09 16:18:50
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/perl-Protocol-HTTP2 (Old)
and /work/SRC/openSUSE:Factory/.perl-Protocol-HTTP2.new.1265 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "perl-Protocol-HTTP2"
Wed Sep 9 16:18:50 2026 rev:6 rq:1376329 version:1.140.0
Changes:
--------
--- /work/SRC/openSUSE:Factory/perl-Protocol-HTTP2/perl-Protocol-HTTP2.changes
2026-06-09 14:14:40.790623708 +0200
+++
/work/SRC/openSUSE:Factory/.perl-Protocol-HTTP2.new.1265/perl-Protocol-HTTP2.changes
2026-09-09 16:21:10.276076141 +0200
@@ -1,0 +2,11 @@
+Fri Sep 4 09:42:47 UTC 2026 - Tina Müller <[email protected]>
+
+- updated to 1.140.0 (1.14)
+ see /usr/share/doc/packages/perl-Protocol-HTTP2/Changes
+
+ 1.14 2026-09-03T14:10:30Z
+ - security fix: CVE-2026-16028 - memory exhaustion, a remote
denial-of-service
+ (reported by Robert Rothenberg, CPAN Security Group)
+ - licence: GPL-1 has been updated with the correct links to FSF (#19)
+
+-------------------------------------------------------------------
Old:
----
Protocol-HTTP2-1.13.tar.gz
New:
----
Protocol-HTTP2-1.14.tar.gz
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ perl-Protocol-HTTP2.spec ++++++
--- /var/tmp/diff_new_pack.CRk9k3/_old 2026-09-09 16:21:11.085109854 +0200
+++ /var/tmp/diff_new_pack.CRk9k3/_new 2026-09-09 16:21:11.086109895 +0200
@@ -18,10 +18,10 @@
%define cpan_name Protocol-HTTP2
Name: perl-Protocol-HTTP2
-Version: 1.130.0
+Version: 1.140.0
Release: 0
-# 1.13 -> normalize -> 1.130.0
-%define cpan_version 1.13
+# 1.14 -> normalize -> 1.140.0
+%define cpan_version 1.14
License: Artistic-1.0 OR GPL-1.0-or-later
Summary: HTTP/2 protocol implementation (RFC 7540)
URL: https://metacpan.org/release/%{cpan_name}
++++++ Protocol-HTTP2-1.13.tar.gz -> Protocol-HTTP2-1.14.tar.gz ++++++
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/Protocol-HTTP2-1.13/Changes
new/Protocol-HTTP2-1.14/Changes
--- old/Protocol-HTTP2-1.13/Changes 2026-06-07 11:19:25.000000000 +0200
+++ new/Protocol-HTTP2-1.14/Changes 2026-09-03 16:10:31.000000000 +0200
@@ -1,5 +1,10 @@
Revision history for Perl extension Protocol-HTTP2
+1.14 2026-09-03T14:10:30Z
+ - security fix: CVE-2026-16028 - memory exhaustion, a remote
denial-of-service
+ (reported by Robert Rothenberg, CPAN Security Group)
+ - licence: GPL-1 has been updated with the correct links to FSF (#19)
+
1.13 2026-06-07T09:19:24Z
- security fix: CVE-2026-10725 - HTTP/2 Bomb, a remote denial-of-service
(reported by Robert Rothenberg, CPAN Security Group)
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/Protocol-HTTP2-1.13/LICENSE
new/Protocol-HTTP2-1.14/LICENSE
--- old/Protocol-HTTP2-1.13/LICENSE 2026-06-07 11:19:25.000000000 +0200
+++ new/Protocol-HTTP2-1.14/LICENSE 2026-09-03 16:10:31.000000000 +0200
@@ -22,7 +22,7 @@
Version 1, February 1989
Copyright (C) 1989 Free Software Foundation, Inc.
- 51 Franklin St, Suite 500, Boston, MA 02110-1335 USA
+ <https://fsf.org/>
Everyone is permitted to copy and distribute verbatim copies
of this license document, but changing it is not allowed.
@@ -236,8 +236,7 @@
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
- along with this program; if not, write to the Free Software
- Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston MA 02110-1301
USA
+ along with this program; if not, see <https://www.gnu.org/licenses/>.
Also add information on how to contact you by electronic and paper mail.
@@ -264,8 +263,8 @@
program `Gnomovision' (a program to direct compilers to make passes
at assemblers) written by James Hacker.
- <signature of Ty Coon>, 1 April 1989
- Ty Coon, President of Vice
+ <signature of Moe Ghoul>, 1 April 1989
+ Moe Ghoul, President of Vice
That's all there is to it!
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/Protocol-HTTP2-1.13/META.json
new/Protocol-HTTP2-1.14/META.json
--- old/Protocol-HTTP2-1.13/META.json 2026-06-07 11:19:25.000000000 +0200
+++ new/Protocol-HTTP2-1.14/META.json 2026-09-03 16:10:31.000000000 +0200
@@ -63,7 +63,7 @@
"provides" : {
"Protocol::HTTP2" : {
"file" : "lib/Protocol/HTTP2.pm",
- "version" : "1.13"
+ "version" : "1.14"
},
"Protocol::HTTP2::Client" : {
"file" : "lib/Protocol/HTTP2/Client.pm"
@@ -147,7 +147,7 @@
"web" : "https://github.com/vlet/p5-Protocol-HTTP2";
}
},
- "version" : "1.13",
+ "version" : "1.14",
"x_contributors" : [
"Daniil Bondarev <[email protected]>",
"Daniil Bondarev <[email protected]>",
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/Protocol-HTTP2-1.13/META.yml
new/Protocol-HTTP2-1.14/META.yml
--- old/Protocol-HTTP2-1.13/META.yml 2026-06-07 11:19:25.000000000 +0200
+++ new/Protocol-HTTP2-1.14/META.yml 2026-09-03 16:10:31.000000000 +0200
@@ -30,7 +30,7 @@
provides:
Protocol::HTTP2:
file: lib/Protocol/HTTP2.pm
- version: '1.13'
+ version: '1.14'
Protocol::HTTP2::Client:
file: lib/Protocol/HTTP2/Client.pm
Protocol::HTTP2::Connection:
@@ -85,7 +85,7 @@
bugtracker: https://github.com/vlet/p5-Protocol-HTTP2/issues
homepage: https://github.com/vlet/p5-Protocol-HTTP2
repository: https://github.com/vlet/p5-Protocol-HTTP2.git
-version: '1.13'
+version: '1.14'
x_contributors:
- 'Daniil Bondarev <[email protected]>'
- 'Daniil Bondarev <[email protected]>'
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/Protocol-HTTP2-1.13/lib/Protocol/HTTP2/Connection.pm
new/Protocol-HTTP2-1.14/lib/Protocol/HTTP2/Connection.pm
--- old/Protocol-HTTP2-1.13/lib/Protocol/HTTP2/Connection.pm 2026-06-07
11:19:25.000000000 +0200
+++ new/Protocol-HTTP2-1.14/lib/Protocol/HTTP2/Connection.pm 2026-09-03
16:10:31.000000000 +0200
@@ -30,6 +30,8 @@
type => $type,
streams => {},
+ closed_streams => [],
+ max_closed_streams => PH2_MAX_CLOSED_STREAMS,
last_stream => $type == CLIENT ? 1 : 2,
last_peer_stream => 0,
@@ -93,7 +95,7 @@
}, $class;
- for (qw(on_change_state on_new_peer_stream on_error upgrade)) {
+ for (qw(on_change_state on_new_peer_stream on_error upgrade
max_closed_streams)) {
$self->{$_} = $opts{$_} if exists $opts{$_};
}
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/Protocol-HTTP2-1.13/lib/Protocol/HTTP2/Constants.pm
new/Protocol-HTTP2-1.14/lib/Protocol/HTTP2/Constants.pm
--- old/Protocol-HTTP2-1.13/lib/Protocol/HTTP2/Constants.pm 2026-06-07
11:19:25.000000000 +0200
+++ new/Protocol-HTTP2-1.14/lib/Protocol/HTTP2/Constants.pm 2026-09-03
16:10:31.000000000 +0200
@@ -84,6 +84,9 @@
SETTINGS_MAX_FRAME_SIZE => 5,
SETTINGS_MAX_HEADER_LIST_SIZE => 6,
+ # Protocol::HTTP2 Settings
+ PH2_MAX_CLOSED_STREAMS => 65_535
+
};
require Exporter;
@@ -110,7 +113,7 @@
qw(MAX_INT_SIZE MAX_PAYLOAD_SIZE PING_PAYLOAD_SIZE MAX_FCW_SIZE
DEFAULT_WEIGHT DEFAULT_HEADER_TABLE_SIZE
DEFAULT_MAX_CONCURRENT_STREAMS
DEFAULT_ENABLE_PUSH DEFAULT_INITIAL_WINDOW_SIZE
DEFAULT_MAX_FRAME_SIZE
- DEFAULT_MAX_HEADER_LIST_SIZE FRAME_HEADER_SIZE)
+ DEFAULT_MAX_HEADER_LIST_SIZE FRAME_HEADER_SIZE
PH2_MAX_CLOSED_STREAMS)
],
states => [qw(IDLE RESERVED OPEN HALF_CLOSED CLOSED)],
endpoints => [qw(CLIENT SERVER)],
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/Protocol-HTTP2-1.13/lib/Protocol/HTTP2/Stream.pm
new/Protocol-HTTP2-1.14/lib/Protocol/HTTP2/Stream.pm
--- old/Protocol-HTTP2-1.13/lib/Protocol/HTTP2/Stream.pm 2026-06-07
11:19:25.000000000 +0200
+++ new/Protocol-HTTP2-1.14/lib/Protocol/HTTP2/Stream.pm 2026-09-03
16:10:31.000000000 +0200
@@ -123,6 +123,12 @@
);
delete $s->{$key};
}
+
+ # Prevent endless growth of closed streams structure
+ # Drop old closed streams (possible violation of the standard)
+ push @{ $self->{closed_streams} }, $stream_id;
+ delete $self->{streams}->{ shift @{ $self->{closed_streams} } }
+ if @{ $self->{closed_streams} } >
$self->{max_closed_streams}
}
}
}
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/Protocol-HTTP2-1.13/lib/Protocol/HTTP2.pm
new/Protocol-HTTP2-1.14/lib/Protocol/HTTP2.pm
--- old/Protocol-HTTP2-1.13/lib/Protocol/HTTP2.pm 2026-06-07
11:19:25.000000000 +0200
+++ new/Protocol-HTTP2-1.14/lib/Protocol/HTTP2.pm 2026-09-03
16:10:31.000000000 +0200
@@ -3,7 +3,7 @@
use strict;
use warnings;
-our $VERSION = "1.13";
+our $VERSION = "1.14";
sub ident_plain {
'h2c';
++++++ _scmsync.obsinfo ++++++
--- /var/tmp/diff_new_pack.CRk9k3/_old 2026-09-09 16:21:11.286118230 +0200
+++ /var/tmp/diff_new_pack.CRk9k3/_new 2026-09-09 16:21:11.292118480 +0200
@@ -1,6 +1,6 @@
-mtime: 1780924302
-commit: 854effe3e4f0832ffd56637db81b30c7363de61beed5ec5754ca08299e62c02c
+mtime: 1788514968
+commit: 0c4777db57c3689b5465130afd75a36a5eb9dfbd5b4bc537d962e1fac73dcfa0
url: https://src.opensuse.org/perl/perl-Protocol-HTTP2
-revision: 854effe3e4f0832ffd56637db81b30c7363de61beed5ec5754ca08299e62c02c
+revision: 0c4777db57c3689b5465130afd75a36a5eb9dfbd5b4bc537d962e1fac73dcfa0
projectscmsync: https://src.opensuse.org/perl/_ObsPrj
++++++ build.specials.obscpio ++++++
++++++ build.specials.obscpio ++++++
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/.gitignore new/.gitignore
--- old/.gitignore 1970-01-01 01:00:00.000000000 +0100
+++ new/.gitignore 2026-09-04 11:42:48.000000000 +0200
@@ -0,0 +1 @@
+.osc
