Script 'mail_helper' called by obssrc
Hello community,
here is the log from the commit of package python-PyMuPDF for openSUSE:Factory
checked in at 2026-09-19 22:20:08
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/python-PyMuPDF (Old)
and /work/SRC/openSUSE:Factory/.python-PyMuPDF.new.383539 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "python-PyMuPDF"
Sat Sep 19 22:20:08 2026 rev:34 rq:1378854 version:1.28.2
Changes:
--------
--- /work/SRC/openSUSE:Factory/python-PyMuPDF/python-PyMuPDF.changes
2026-08-25 13:19:23.641487761 +0200
+++
/work/SRC/openSUSE:Factory/.python-PyMuPDF.new.383539/python-PyMuPDF.changes
2026-09-19 22:20:57.316135803 +0200
@@ -1,0 +2,19 @@
+Wed Sep 16 09:22:45 UTC 2026 - Markéta Machová <[email protected]>
+
+- Update to 1.28.2
+ * pymupdf.Document.__init__(): new arg `archive` to support documents
+ with archives.
+ * pymupdf.Document.convert_to_pdf(): also generate links.
+ * pymupdf.Document.save() now saves non-PDF documents in PDF format.
+ * New method pymupdf.Document.apply_css().
+ * Use MuPDF-1.28.2.
+ * Output warning when legacy `fitz` module is imported.
+ * Cope better with markdown containing illegal utf8 sequences.
+ * Fixed building with PYMUPDF_SETUP_MUPDF_VS_UPGRADE.
+ * pymupdf.Page.find_tables() improvements
+- Enable multiflavor build and support libalternatives
+- CVE-2026-82035: a path traversal vulnerability in the font branch
+ of extract_objects() in src/__main__.py (bsc#1280486)
+ * CVE-2026-82035.patch
+
+-------------------------------------------------------------------
Old:
----
mupdf-1.27.2-source.tar.gz
pymupdf-1.27.2.2.tar.gz
New:
----
CVE-2026-82035.patch
mupdf-1.28.2-source.tar.gz
pymupdf-1.28.2.tar.gz
----------(New B)----------
New: of extract_objects() in src/__main__.py (bsc#1280486)
* CVE-2026-82035.patch
----------(New E)----------
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ python-PyMuPDF.spec ++++++
--- /var/tmp/diff_new_pack.B5piqV/_old 2026-09-19 22:20:59.683234536 +0200
+++ /var/tmp/diff_new_pack.B5piqV/_new 2026-09-19 22:20:59.690234827 +0200
@@ -19,24 +19,26 @@
# Python 2 build fails always
%define skip_python2 1
%define pypi_name pymupdf
-%define mupdf_version 1.27.2
+%define mupdf_version 1.28.2
%{?sle15_python_module_pythons}
-#python3-clangxx is only available for python 3.13
-%define pythons python313
+%bcond_without libalternatives
Name: python-PyMuPDF
-Version: 1.27.2.2
+Version: 1.28.2
Release: 0
Summary: Python binding for MuPDF, a PDF and XPS viewer
License: AGPL-3.0-only
Group: Development/Libraries/Python
URL: https://github.com/pymupdf/PyMuPDF
Source:
https://files.pythonhosted.org/packages/source/P/PyMuPDF/pymupdf-%{version}.tar.gz
-Source1: mupdf-%{mupdf_version}-source.tar.gz
+Source1:
https://casper.mupdf.com/downloads/archive/mupdf-%{mupdf_version}-source.tar.gz
+# PATCH-FIX-UPSTREAM CVE-2026-82035.patch bsc#1280486
+Patch0: CVE-2026-82035.patch
BuildRequires: %{python_module certifi}
BuildRequires: %{python_module devel}
+BuildRequires: %{python_module pipcl}
BuildRequires: %{python_module pip}
-BuildRequires: %{python_module setuptools}
BuildRequires: %{python_module wheel}
+BuildRequires: alts
BuildRequires: clang19-devel
%if 0%{?suse_version} >= 1699
BuildRequires: llvm21-libclang13
@@ -56,6 +58,7 @@
BuildRequires: pkgconfig(libopenjp2)
BuildRequires: pkgconfig(libpng16)
BuildRequires: pkgconfig(zlib)
+Requires: alts
Provides: bundled(mupdf) = %version
# mupdf has bundled() on its own, too, so kinda bad
%python_subpackages
@@ -83,10 +86,13 @@
export ARCHFLAGS="%{optflags}"
# -D makes .a files deterministic
export AR="ar -D"
+# desperate attempt to make it build, dunno why it worked
+export PYTHONPATH=%{python3_sitelib}
%pyproject_wheel
%install
%pyproject_install
+%python_clone -a %{buildroot}%{_bindir}/pymupdf
%python_expand %fdupes %{buildroot}%{$python_sitearch}
%check
@@ -100,7 +106,7 @@
%{python_sitearch}/[Pp]y[Mm]u[Pp][Dd][Ff]-%{version}*info
%{python_sitearch}/fitz/
%{python_sitearch}/pymupdf/
-%{_bindir}/pymupdf
+%python_alternative %{_bindir}/pymupdf
%exclude %{python_sitearch}/pymupdf/mupdf-devel/
%files %{python_files devel}
++++++ CVE-2026-82035.patch ++++++
>From b2c8f3a859fed35c379a44df566f770dc3e18605 Mon Sep 17 00:00:00 2001
From: Julian Smith <[email protected]>
Date: Tue, 8 Sep 2026 10:27:41 +0100
Subject: [PATCH] src/__main__.py: extract_objects(): avoid path escape from
directory.
We need to escape '/' and '\' characters.
Fixes https://bugs.ghostscript.com/show_bug.cgi?id=709683.
---
src/__main__.py | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/src/__main__.py b/src/__main__.py
index 398da7b73..51cd99e24 100644
--- a/src/__main__.py
+++ b/src/__main__.py
@@ -517,8 +517,12 @@ def extract_objects(args):
fontname, ext, _, buffer = doc.extract_font(xref)
if ext == "n/a" or not buffer:
continue
+ name = fontname
+ name = name.replace('/', '-')
+ name = name.replace('\\', '-')
+ name = name.replace(' ', '-')
outname = os.path.join(
- out_dir, f"{fontname.replace(' ', '-')}-{xref}.{ext}"
+ out_dir, f"{name}-{xref}.{ext}"
)
with open(outname, "wb") as outfile:
outfile.write(buffer)
++++++ mupdf-1.27.2-source.tar.gz -> mupdf-1.28.2-source.tar.gz ++++++
/work/SRC/openSUSE:Factory/python-PyMuPDF/mupdf-1.27.2-source.tar.gz
/work/SRC/openSUSE:Factory/.python-PyMuPDF.new.383539/mupdf-1.28.2-source.tar.gz
differ: char 5, line 1
++++++ pymupdf-1.27.2.2.tar.gz -> pymupdf-1.28.2.tar.gz ++++++
/work/SRC/openSUSE:Factory/python-PyMuPDF/pymupdf-1.27.2.2.tar.gz
/work/SRC/openSUSE:Factory/.python-PyMuPDF.new.383539/pymupdf-1.28.2.tar.gz
differ: char 5, line 1
