Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package python-aiosmtplib for openSUSE:Factory checked in at 2026-09-16 17:41:19 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/python-aiosmtplib (Old) and /work/SRC/openSUSE:Factory/.python-aiosmtplib.new.383539 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "python-aiosmtplib" Wed Sep 16 17:41:19 2026 rev:20 rq:1378082 version:5.1.3 Changes: -------- --- /work/SRC/openSUSE:Factory/python-aiosmtplib/python-aiosmtplib.changes 2026-08-21 17:03:14.124118452 +0200 +++ /work/SRC/openSUSE:Factory/.python-aiosmtplib.new.383539/python-aiosmtplib.changes 2026-09-16 17:42:16.764891341 +0200 @@ -1,0 +2,48 @@ +Mon Sep 14 14:24:40 UTC 2026 - Nico Krapp <[email protected]> + +- Update to 5.1.3 (fixes CVE-2026-90467 (bsc#1280277)): + * Security: reject addresses containing whitespace or angle brackets outside + of a quoted local part in mail, rcpt, vrfy, expn and sendmail. + Previously, a caller supplied address such as + [email protected]> AUTH=<[email protected] could smuggle additional ESMTP + parameters onto the command line. This is a follow up to the fix in 5.1.1 for + CVE-2026-53533 (GHSA-v3q9-hj7j-63hq), which only rejected control characters. + sendmail now validates all addresses before sending any commands. + * Bugfix: reject local_hostname values (and the hostname argument to + helo/ehlo) containing whitespace or control characters, so a hostname + such as me.example.com XCLIENT ADDR=1.2.3.4 can no longer smuggle extra + parameters onto the EHLO/HELO command line. Surrounding whitespace is stripped. + * Bugfix: raise SMTPAuthenticationError instead of binascii.Error when the + server sends a malformed (non-base64) CRAM-MD5 challenge, so login can fall + back to the next auth method + * Bugfix: prevent SMTP command/response desync from unsolicited server data (thanks + @Charisn for contributing) + * Bugfix: handle protocol connection lost callback arriving after reconnect + * Bugfix: close connection on async context manager exit in cases of a server error response + * Bugfix: release connection lock on connect timeout + * Bugfix: re-derive the default port on each connect() so changing + use_tls/start_tls between connects no longer reuses a stale default. + Defaulted port/hostname are now resolved per-connect rather than + written back onto the instance, so they read back as None when unset + * Bugfix: typeerror in latest ty + * Bugfix: mark response waiter exceptions as retrieved when they are set, so + Future exception was never retrieved is no longer logged on free-threaded + builds where the previous __del__ based cleanup ran too late + * CI: test on free-threaded 3.14 and on 3.15 (standard and free-threaded) + * Bugfix: the SIZE parameter sent with MAIL FROM now reports the number + of octets as the message will be transmitted (with CRLF line endings), rather + than the raw length of the message argument + * Bugfix: data arriving on the transport after the connection is lost is now + dropped instead of raising RuntimeError from the protocol callback + * Bugfix: SMTPProtocol now records that it is using TLS after a successful + start_tls, so a second upgrade attempt on the protocol is rejected + * Bugfix: starttls now validates its TLS options before sending EHLO, so + invalid options raise ValueError without touching the connection + * Bugfix: helo no longer records a failed response as last_helo_response, + so a rejected HELO does not leave the session looking as if a greeting succeeded + * Bugfix: bytearray and memoryview values are no longer silently passed + through the auth encoding helpers; only str and bytes are accepted, as + the type annotations already stated + * Bugfix: TLS context setup now run in thread (thanks @tr4nt0r) + +------------------------------------------------------------------- Old: ---- aiosmtplib-5.1.2.tar.gz New: ---- aiosmtplib-5.1.3.tar.gz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ python-aiosmtplib.spec ++++++ --- /var/tmp/diff_new_pack.DVDiGQ/_old 2026-09-16 17:42:18.286954938 +0200 +++ /var/tmp/diff_new_pack.DVDiGQ/_new 2026-09-16 17:42:18.288955022 +0200 @@ -18,7 +18,7 @@ %{?sle15_python_module_pythons} Name: python-aiosmtplib -Version: 5.1.2 +Version: 5.1.3 Release: 0 Summary: Python asyncio SMTP client License: MIT @@ -39,8 +39,8 @@ # SECTION test requirements BuildRequires: %{python_module aiosmtpd >= 1.4.2} BuildRequires: %{python_module hypothesis >= 6.56} -BuildRequires: %{python_module pytest >= 7.2} -BuildRequires: %{python_module pytest-asyncio >= 0.20.1} +BuildRequires: %{python_module pytest >= 8.2} +BuildRequires: %{python_module pytest-asyncio >= 1.4.0} # /SECTION %python_subpackages ++++++ aiosmtplib-5.1.2.tar.gz -> aiosmtplib-5.1.3.tar.gz ++++++ ++++ 1711 lines of diff (skipped)
