Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package netbird for openSUSE:Factory checked in at 2026-10-03 20:14:55 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/netbird (Old) and /work/SRC/openSUSE:Factory/.netbird.new.1631729 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "netbird" Sat Oct 3 20:14:55 2026 rev:48 rq:1382251 version:0.80.0 Changes: -------- --- /work/SRC/openSUSE:Factory/netbird/netbird.changes 2026-09-19 22:24:15.904418441 +0200 +++ /work/SRC/openSUSE:Factory/.netbird.new.1631729/netbird.changes 2026-10-03 20:16:27.365939452 +0200 @@ -1,0 +2,201 @@ +Thu Oct 1 21:51:47 UTC 2026 - Marcus Rueckert <[email protected]> + +- Update to 0.80.0 + - 🔒 Security and Access Control + - Refused to pin an agent network gateway onto another + account's host, adding cross-account validation for gateway + assignments. #7519 + - Validated proxy cluster on Agent Network bootstrap, + preventing an agent network from bootstrapping onto another + account's proxy cluster. #7402 + - Refused HTTP redirects on IdP clients, preventing open + redirect attacks against identity provider integrations. + #7579 + - Revoked local Dex session on embedded IdP password change, + ensuring sessions are properly invalidated when credentials + are updated. #7556 + - Added upload URL signing and rate limiting for file upload + endpoints. #7502 + - 🖥️ Client Improvements + - Staged install script downloads in a private temp directory, + preventing other processes from tampering with downloaded + files before installation. #7534 + - Enforced HTTPS on install script downloads, ensuring all + client downloads use secure connections. #7545 + - Fixed peers not being notified when the relay connection + drops, which could leave stale peer state after a relay + disconnect. #7490 + - Fixed session deadline read under the status read lock, + preventing a potential race condition. #7550 + - Removed the empty GPO DNS policy store on Windows teardown, + cleaning up leftover DNS policy entries when the client shuts + down. #7563 + - Resolved the shared socket source address through a connected + UDP probe socket, fixing source address resolution for shared + socket mode. #7633 + - Validated saved service parameters and pinned the netsh + lookup on Windows, hardening the service configuration path. + #7584 + - Used POSIX-style file read/write of JSON on Windows, + improving cross-platform config file handling. #7631 + - Raised the daemon IPC receive limit to 16 MB, matching gRPC's + default and preventing truncation of large messages. #7676 + - Skipped route firewall rule computation when no firewall is + configured, avoiding unnecessary work. #7624 + - Fixed device dump clearing all peer endpoints instead of just + the target one, which could disrupt connections to other + peers. #7632 + - Fixed Windows IPC privilege check to only treat LocalSystem + as a privileged identity by SID. Local Service and Network + Service now go through the same checks as any other caller. + #7889 + - Bumped Wails to v3.0.0-beta.25 for the desktop UI. #7640 + - ⚙️ Management Improvements + - Sped up test store setup and summarized unit test runs, + improving CI performance. #7518 + - Read X-Real-IP when extracting the peer connection IP, + supporting deployments behind reverse proxies. #7561 + - Handled empty trusted peer to avoid errors when no trusted + peer is configured. #7589 + - Named the account owner in the pending approval error, making + it clear who to contact for account approval. #7533 + - Fixed group resource validation for proper enforcement. #7608 + - Added store support to filter by public ID. #7208 + - Recorded proxy version on connect for tracking and debugging. + #7630 + - Split store by table for improved database performance and + organization. #7646 + - Prevented deleting custom domains used by services, + protecting active proxy configurations from accidental + removal. #7515 + - Moved rate limiter to shared package for reuse across + services. #7727 + - Let usage_viewer read Agent Network access logs, so users + reviewing cost can now see the requests behind usage metrics. + #7750 + - 🔀 Reverse Proxy + - Closed the client connection on private service denials + instead of leaving it hanging. #7590 + - Added proxy rate limiter to protect against abuse. #7568 + - Added proxy credentials limiter on management to throttle + authentication attempts. #7569 + - Fixed upstream HTTP version applied before cloning + transports. #7806 + - Added release-wired UBI image variant for the proxy. #7464 + - Fixed flow auth secret for external Relay migrations. #7731 + - 🏗️ Infrastructure and CI + - Certified the rootless UBI client image on release for Red + Hat ecosystem compliance. #7525 + - Fixed RPM metadata for Red Hat software certification (two + rounds of fixes). #7562, #7614 + - Added proxy support to enterprise setup. #7651 + - Built the upload server from source, nonroot on Chainguard + for a hardened container image. #7663 + - Built and linted mobile Go code in CI for Android. #7641 + - Bumped workflow actions off the retired Node 20 runtime. + #7644 + - Added Pyroscope profiling to management, signal, and proxy + services. #7536 + - Pointed the agent-config e2e providers at the mock upstream. + #7542 + - Used the Silo image for the S3 upload test. #7619 + - 📝 Misc + - Pointed bug reports at Discussions and added SUPPORT.md. + #7647 + - Added cloud API spec to the public OpenAPI definition with + REST client. #7222 + - Loaded AGENTS.md every session and refused attribution + trailers. #7544 + - What's Changed + - [management] Speed up test store setup and summarize the unit + test run by @mlsmaycon in #7518 + - [management] Refuse to pin an agent network gateway onto + another account's host by @mlsmaycon in #7519 + - [management] Validate the proxy cluster an agent network + bootstraps onto by @mlsmaycon in #7402 + - [management] Point the agent-config e2e providers at the mock + upstream by @mlsmaycon in #7542 + - [client] Stage install script downloads in a private temp + directory by @riccardomanfrin in #7534 + - [client] Read the session deadline under the status read lock + by @pappz in #7550 + - [client] Enforce HTTPS on install script downloads by + @riccardomanfrin in #7545 + - [misc] Load AGENTS.md every session and refuse attribution + trailers by @mlsmaycon in #7544 + - [client] Fix - Add RPM metadata required for Red Hat software + certification by @braginini in #7562 + - [management] Read X-Real-IP when extracting the peer + connection IP by @bcmmbaga in #7561 + - [management] Handle empty trusted peer by @bcmmbaga in #7589 + - [proxy] Close the client connection on private service + denials by @mlsmaycon in #7590 + - [management] Name the account owner in the pending approval + error by @heisbrot in #7533 + - [proxy] add proxy rate limiter by @pascal-fischer in #7568 + - [management] Add proxy credentials limiter on management by + @pascal-fischer in #7569 + - [client] Fix peers not being notified when the relay + connection drops by @pappz in #7490 + - [management] fix group resource validation by @pascal-fischer + in #7608 + - [client] Remove the empty GPO DNS policy store on Windows + teardown by @lixmal in #7563 + - [management] add store support to filter by public id by + @pascal-fischer in #7208 + - [client,management] Skip route firewall rule computation when + no firewall by @riccardomanfrin in #7624 + - [management] record proxy version on connect by + @pascal-fischer in #7630 + - [management,signal,proxy] add pyroscope profiling by + @pascal-fischer in #7536 + - [client] Validate the saved service parameters and pin the + netsh lookup by @riccardomanfrin in #7584 + - [client] Use POSIX style file read/write of json for windows + by @theodorsm in #7631 + - [client] Fix RPM metadata for Red Hat certification by + @braginini in #7614 + - [misc] Bump workflow actions off the retired Node 20 runtime + by @heisbrot in #7644 + - [misc] Add upload URL signing and rate limiting by @bcmmbaga + in #7502 + - [misc] Use the Silo image for the S3 upload test by @Silex in + #7619 + - [management] split store by table by @pascal-fischer in #7646 + - [management] Refuse HTTP redirects on IdP clients by + @bcmmbaga in #7579 + - [management] Revoke local Dex session on embedded IdP + password change by @bcmmbaga in #7556 + - [misc, android] Build and lint the mobile Go code in CI by + @riccardomanfrin in #7641 + - [client] Raise the daemon IPC receive limit gRPC's to 16 MB + by @riccardomanfrin in #7676 + - [misc] Build the upload server from source, nonroot on + Chainguard by @bison in #7663 + - [infrastructure] Certify the rootless UBI client image on + release by @braginini in #7525 + - [client] Resolve the shared socket source address through a + connected UDP probe socket by @lixmal in #7633 + - [proxy] Add a release-wired UBI image variant by @jnfrati in + #7464 + - [infrastructure] Add proxy support to enterprise setup by + @bcmmbaga in #7651 + - [doc] Point bug reports at Discussions and add SUPPORT.md by + @thomashacker in #7647 + - [management] Prevent deleting custom domains used by services + by @mlsmaycon in #7515 + - [management] move rate limiter to shared package by + @pascal-fischer in #7727 + - [client] Bump wails to v3.0.0-beta.25 by @pappz in #7640 + - [client] Stop dumping the whole device to clear one peer + endpoint by @lixmal in #7632 + - [infrastructure] Fix flow auth secret for external Relay + migrations by @braginini in #7731 + - [proxy] Apply the upstream HTTP version before cloning + transports by @mlsmaycon in #7806 + - [management] Let usage_viewer read Agent Network access logs + by @jnfrati in #7750 + - [client] Only treat LocalSystem as a privileged identity by + SID on Windows by @lixmal in #7889 + +------------------------------------------------------------------- Old: ---- netbird-0.79.0.obscpio New: ---- netbird-0.80.0.obscpio ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ netbird.spec ++++++ --- /var/tmp/diff_new_pack.i7lz3i/_old 2026-10-03 20:16:29.641034581 +0200 +++ /var/tmp/diff_new_pack.i7lz3i/_new 2026-10-03 20:16:29.643034665 +0200 @@ -32,7 +32,7 @@ %bcond_with stub_config Name: netbird -Version: 0.79.0 +Version: 0.80.0 Release: 0 Summary: Mesh VPN based on WireGuard License: AGPL-3.0-only AND BSD-3-Clause @@ -333,6 +333,7 @@ TestICEBind_HandlesConcurrentMixedTraffic TestRedirectAs_\* TestSSHProxy_CommandQuoting + TestJWTCache* ) # Assemble skip string by replacing spaces with a pipe. disable=$(echo ${failing_tests[*]} | sed 's/ /|/g') ++++++ _service ++++++ --- /var/tmp/diff_new_pack.i7lz3i/_old 2026-10-03 20:16:29.691036672 +0200 +++ /var/tmp/diff_new_pack.i7lz3i/_new 2026-10-03 20:16:29.695036839 +0200 @@ -3,7 +3,7 @@ <param name="url">https://github.com/netbirdio/netbird.git</param> <param name="scm">git</param> <param name="package-meta">yes</param> - <param name="revision">refs/tags/v0.79.0</param> + <param name="revision">refs/tags/v0.80.0</param> <param name="versionformat">@PARENT_TAG@</param> <param name="versionrewrite-pattern">v(.*)</param> <param name="changesgenerate">disable</param> ++++++ netbird-0.79.0.obscpio -> netbird-0.80.0.obscpio ++++++ /work/SRC/openSUSE:Factory/netbird/netbird-0.79.0.obscpio /work/SRC/openSUSE:Factory/.netbird.new.1631729/netbird-0.80.0.obscpio differ: char 49, line 1 ++++++ netbird.obsinfo ++++++ --- /var/tmp/diff_new_pack.i7lz3i/_old 2026-10-03 20:16:29.786040644 +0200 +++ /var/tmp/diff_new_pack.i7lz3i/_new 2026-10-03 20:16:29.790040812 +0200 @@ -1,5 +1,5 @@ name: netbird -version: 0.79.0 -mtime: 1789745353 -commit: 396795ebb6822402ad4eff88c90682d99f77d987 +version: 0.80.0 +mtime: 1790863139 +commit: fca64287cf51a85552a41b022013abbfdb335452 ++++++ vendor.tar.zst ++++++ /work/SRC/openSUSE:Factory/netbird/vendor.tar.zst /work/SRC/openSUSE:Factory/.netbird.new.1631729/vendor.tar.zst differ: char 7, line 1
