Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package grafana for openSUSE:Factory checked in at 2026-09-29 17:49:47 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/grafana (Old) and /work/SRC/openSUSE:Factory/.grafana.new.383539 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "grafana" Tue Sep 29 17:49:47 2026 rev:97 rq:1381235 version:12.4.11 Changes: -------- --- /work/SRC/openSUSE:Factory/grafana/grafana.changes 2026-09-04 12:42:20.558656529 +0200 +++ /work/SRC/openSUSE:Factory/.grafana.new.383539/grafana.changes 2026-09-29 17:51:33.372657840 +0200 @@ -1,0 +2,24 @@ +Thu Sep 17 13:01:40 UTC 2026 - Witek Bedyk <[email protected]> + +- Update to version 12.4.11: + * Security: + CVE-2026-15815: Fix Grafana Plugin extraction zip slip + (bsc#1281451) + CVE-2026-76154: Fix Geomap MapLibre XSS + Fix CVE-2026-79656 + CVE-2026-56855,CVE-2026-56854,CVE-2026-78662: Fix + authentication bypass and deadlocks by bumping crypto/ssh + library to version 0.56.0 (bsc#1278576) + CVE-2026-84445: Fix DoS via crash due to missing `:authority` + and `Host` headers in gRPC-Go xDS servers by + bumping google.golang.org/grpc to version + 1.83.2 (bsc#1278936) + CVE-2026-84304: Fix Heap Memory Exhaustion via HTTP/2 DATA + Frame Fragmentation in gRPC-Go by bumping it to + version 1.83.2 (bsc#1279204) + CVE-2026-84303: Fix xDS RBAC HTTP Filter bypass via mixed-case + Header Matching and gRFC A41 validation evasion + by bumping google.golang.org/grpc to version + 1.83.2 (bsc#1279299) + +------------------------------------------------------------------- @@ -16,0 +41,3 @@ + CVE-2026-83530: Bump github.com/google/cel-go to version 0.31.0 + to enforce expression size limit before source + construction (bsc#1279990) Old: ---- grafana-12.4.10.tar.gz ui-12.4.10.tar.gz New: ---- grafana-12.4.11.tar.gz ui-12.4.11.tar.gz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ grafana.spec ++++++ --- /var/tmp/diff_new_pack.5sEGBR/_old 2026-09-29 17:51:38.095855069 +0200 +++ /var/tmp/diff_new_pack.5sEGBR/_new 2026-09-29 17:51:38.097855152 +0200 @@ -22,7 +22,7 @@ %endif Name: grafana -Version: 12.4.10 +Version: 12.4.11 Release: 0 Summary: The open-source platform for monitoring and observability License: AGPL-3.0-only ++++++ grafana-12.4.10.tar.gz -> grafana-12.4.11.tar.gz ++++++ /work/SRC/openSUSE:Factory/grafana/grafana-12.4.10.tar.gz /work/SRC/openSUSE:Factory/.grafana.new.383539/grafana-12.4.11.tar.gz differ: char 13, line 1 ++++++ ui-12.4.10.tar.gz -> ui-12.4.11.tar.gz ++++++ /work/SRC/openSUSE:Factory/grafana/ui-12.4.10.tar.gz /work/SRC/openSUSE:Factory/.grafana.new.383539/ui-12.4.11.tar.gz differ: char 13, line 1 ++++++ vendor.tar.gz ++++++ /work/SRC/openSUSE:Factory/grafana/vendor.tar.gz /work/SRC/openSUSE:Factory/.grafana.new.383539/vendor.tar.gz differ: char 5, line 1
