Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package apptainer for openSUSE:Factory checked in at 2026-09-21 12:22:13 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/apptainer (Old) and /work/SRC/openSUSE:Factory/.apptainer.new.383539 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "apptainer" Mon Sep 21 12:22:13 2026 rev:51 rq:1379336 version:1.5.3 Changes: -------- --- /work/SRC/openSUSE:Factory/apptainer/apptainer.changes 2026-09-02 16:59:29.035554427 +0200 +++ /work/SRC/openSUSE:Factory/.apptainer.new.383539/apptainer.changes 2026-09-21 12:22:15.205869704 +0200 @@ -1,0 +2,18 @@ +Fri Sep 18 06:47:11 UTC 2026 - Egbert Eich <[email protected]> + +- Fix potential authentication bypass and deadlocks in the + crypto/ssh library by updating golang.org/x/crypto to v0.56.0. + CVE-2026-56854,CVE-2026-78662,CVE-2026-56855 (bsc#1278666) +- Fix + * a potential DoS via crash due to missing ':authority' and + 'Host' headers in gRPC-Go xDS servers CVE-2026-84445 (bsc#1279033), + * a potential heap memory exhaustion via HTTP/2 DATA frame + fragmentation CVE-2026-84304 (bsc#1279236), + * a potential bypass of authorization policies via mixed-case + or canonical-case header matches due to an xDS RBAC HTTP filter + implementation issue CVE-2026-84303 (bsc#1279333) + by updating google.golang.org/grpc to v1.83.2 +- Remove replacement of golang.org/x/net to @v0.57.0 as the update + of google.golang.org/grpc already requires @v0.58.0 + +------------------------------------------------------------------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ _scmsync.obsinfo ++++++ --- /var/tmp/diff_new_pack.0Hr5jw/_old 2026-09-21 12:22:18.108991037 +0200 +++ /var/tmp/diff_new_pack.0Hr5jw/_new 2026-09-21 12:22:18.111991162 +0200 @@ -1,4 +1,4 @@ -mtime: 1788272528 -commit: 6d5dba0a88e6350a762021d04dfed66f1337132b0d414a4995db8a2fe7e7360f +mtime: 1789717458 +commit: be3795c082f52a1fb641334f098371a7435b727d46361c00999bba46ef621cf6 url: https://src.opensuse.org/Cluster/apptainer.git ++++++ _service ++++++ --- /var/tmp/diff_new_pack.0Hr5jw/_old 2026-09-21 12:22:18.133992082 +0200 +++ /var/tmp/diff_new_pack.0Hr5jw/_new 2026-09-21 12:22:18.136992207 +0200 @@ -1,14 +1,17 @@ <services> <service name="go_modules" mode="disabled"> <param name="replace"> - golang.org/x/net=golang.org/x/[email protected] - </param> - <param name="replace"> github.com/moby/go-archive=github.com/moby/[email protected] </param> <param name="replace"> go.opentelemetry.io/otel=go.opentelemetry.io/[email protected] </param> + <param name="replace"> + golang.org/x/crypto=golang.org/x/[email protected] + </param> + <param name="replace"> + google.golang.org/grpc=google.golang.org/[email protected] + </param> </service> </services> ++++++ build.specials.obscpio ++++++ ++++++ build.specials.obscpio ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/.gitignore new/.gitignore --- old/.gitignore 1970-01-01 01:00:00.000000000 +0100 +++ new/.gitignore 2026-09-18 09:44:18.000000000 +0200 @@ -0,0 +1,8 @@ +*.obscpio +*.osc +_build.* +.pbuild +*.obscpio +*.osc +_build.* +.pbuild ++++++ vendor.tar.gz ++++++ /work/SRC/openSUSE:Factory/apptainer/vendor.tar.gz /work/SRC/openSUSE:Factory/.apptainer.new.383539/vendor.tar.gz differ: char 48, line 1
