Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package xz for openSUSE:Factory checked in at 2026-09-16 17:40:26 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/xz (Old) and /work/SRC/openSUSE:Factory/.xz.new.383539 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "xz" Wed Sep 16 17:40:26 2026 rev:97 rq:1378000 version:5.8.4 Changes: -------- --- /work/SRC/openSUSE:Factory/xz/xz.changes 2026-04-04 19:03:58.836670933 +0200 +++ /work/SRC/openSUSE:Factory/.xz.new.383539/xz.changes 2026-09-16 17:40:29.239398529 +0200 @@ -1,0 +2,28 @@ +Sat Sep 12 08:16:15 UTC 2026 - Andrea Manzini <[email protected]> + +- Update to version 5.8.4: + * Fix an invalid memory access in lzma_alone_decoder(), + lzma_lzip_decoder(), lzma_auto_decoder(), and + lzma_microlzma_decoder() after a failed allocation is + followed by decoder reinitialization; could crash + (GHSA-5qpq-xqfv-j9pg, CVE pending, affects all versions + since 5.0.0) + * Fix wrong error code/assertion failure in + lzma_stream_buffer_decode() on truncated input + * Fix a performance issue and a theoretical integer + overflow in lzma_index_cat(), used by "xz --list" + * Fix bogus/too-low memory usage reporting in + lzma_index_decoder() + * Fix lzma_index_dup() copying the wrong check type + * Fix a missing synchronization in the threaded .xz + decoder affecting lzma_get_progress() + * xz: fix two use-after-free bugs (--files/--files0 via + XZ_OPT/XZ_DEFAULTS, and --verbose with redirected stderr) + * Add Landlock ABI 9 support on Linux + * Fix "xz --list" totals overflow check, an xzgrep option- + injection quoting bug, and an ARM64/LoongArch unaligned- + read issue; see upstream's release notes for the full list +- spec-cleaner cleanup: drop Group: tags, convert + static-devel's Requires to pkgconfig(liblzma) + +------------------------------------------------------------------- Old: ---- xz-5.8.3.tar.xz xz-5.8.3.tar.xz.sig New: ---- xz-5.8.4.tar.xz xz-5.8.4.tar.xz.sig ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ xz.spec ++++++ --- /var/tmp/diff_new_pack.VSsmFV/_old 2026-09-16 17:40:31.661499733 +0200 +++ /var/tmp/diff_new_pack.VSsmFV/_new 2026-09-16 17:40:31.663499817 +0200 @@ -24,11 +24,10 @@ %bcond_with static %endif Name: xz -Version: 5.8.3 +Version: 5.8.4 Release: 0 Summary: A Program for Compressing Files with the Lempel–Ziv–Markov algorithm License: 0BSD AND GPL-2.0-or-later AND GPL-3.0-or-later AND LGPL-2.1-or-later -Group: Productivity/Archiving/Compression URL: https://tukaani.org/xz/ Source0: https://github.com/tukaani-project/xz/releases/download/v%{version}/xz-%{version}.tar.xz Source1: https://github.com/tukaani-project/xz/releases/download/v%{version}/xz-%{version}.tar.xz.sig @@ -60,7 +59,6 @@ %package -n liblzma5 Summary: Lempel–Ziv–Markov chain algorithm compression library License: 0BSD -Group: System/Libraries %description -n liblzma5 Library for encoding/decoding LZMA files. @@ -68,7 +66,6 @@ %package devel Summary: Development package for the LZMA library License: 0BSD -Group: Development/Libraries/C and C++ Requires: liblzma5 = %{version} Provides: lzma-devel = %{version} Obsoletes: lzma-devel < %{version} @@ -83,8 +80,7 @@ %package static-devel Summary: Static version of LZMA library License: LicenseRef-SUSE-Public-Domain -Group: Development/Libraries/C and C++ -Requires: xz-devel = %{version} +Requires: pkgconfig(liblzma) = %{version} %description static-devel Static library for the LZMA library ++++++ xz-5.8.3.tar.xz -> xz-5.8.4.tar.xz ++++++ ++++ 17177 lines of diff (skipped)
