Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package goose for openSUSE:Factory checked in at 2026-10-05 13:01:55 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/goose (Old) and /work/SRC/openSUSE:Factory/.goose.new.3698736 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "goose" Mon Oct 5 13:01:55 2026 rev:9 rq:1382348 version:1.53.0 Changes: -------- --- /work/SRC/openSUSE:Factory/goose/goose.changes 2026-09-28 10:47:50.766455435 +0200 +++ /work/SRC/openSUSE:Factory/.goose.new.3698736/goose.changes 2026-10-05 13:02:11.573252142 +0200 @@ -1,0 +2,40 @@ +Sun Oct 4 07:25:07 UTC 2026 - Martin Pluskal <[email protected]> + +- Update to version 1.53.0: + * a Meta Muse Code provider is registered, and MCP sampling support + is removed + * the CLI gains a session rename command, shows the working directory + in the session remove command, and prints output for tools without + a priority annotation + * model metadata is fetched from models.dev with a bundled fallback; + Opus 5.5, GPT-6-sol and GPT-6-luna are supported, and + deepseek-flash replaces deepseek-v4-flash + * session context is preserved across the reply lifecycle, tool + results stay consecutive when OpenAI-compatible tool images are + emitted, and costs are estimated through canonical provider aliases + * vision support resolves from the canonical catalog everywhere; + max_tokens truncation is reported and tool calls flushed on Bedrock + * the unrolled agent loop auto-compacts at tool boundaries, and inert + parameters are stripped from session snapshots in recipes + * elicitation input requires a terminal and the Extension Manager can + no longer disable itself + * the MCP streamable-HTTP client no longer follows redirects, so + credentials are not forwarded and the client cannot be bounced at + loopback, link-local or cloud-metadata addresses (SSRF) + * goose review passes --no-ext-diff to git diff, so a repository's + diff.external cannot run an arbitrary command (GHSA-6mg9-3cvh-9939) + * an unavailable prompt classifier is treated as no signal instead of + a failure +- boo#1279391 is still open: recipe/mod.rs and the stdio extension + spawn are byte-identical to 1.52.0, and the recipe security scan still + covers only instructions, prompt and activities +- Refresh the vendored dependencies; the linked crate graph shrinks from + 602 to 520 third-party crates (the tree-sitter grammars and the + docx/spreadsheet helpers left the built graph), and the four + crate-bundled C libraries keep their versions +- Re-derive the License tag from the new vendored crate graph + (1336 crates vendored): the 13 SPDX identifiers are unchanged, but + BSD-2-Clause is attributed to the bundled oniguruma, whose COPYING is + now installed as LICENSE.oniguruma + +------------------------------------------------------------------- Old: ---- goose-1.52.0.tar.zst New: ---- goose-1.53.0.tar.zst ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ goose.spec ++++++ --- /var/tmp/diff_new_pack.aBJ2MV/_old 2026-10-05 13:02:54.249041820 +0200 +++ /var/tmp/diff_new_pack.aBJ2MV/_new 2026-10-05 13:02:54.250041862 +0200 @@ -18,7 +18,7 @@ %global goose_features aws-providers,nostr,otel,rustls-tls,system-keyring,disable-update Name: goose -Version: 1.52.0 +Version: 1.53.0 Release: 0 Summary: Extensible open source AI agent that automates engineering tasks # Legal-Review-Notice: goose itself is Apache-2.0, but the shipped binary @@ -26,38 +26,50 @@ # whole linked set. Derived on this vendoring with # "cargo tree --offline -p goose-cli -e normal --no-default-features # --features %%{goose_features}" over the vendored tree -# (1327 crates vendored, 602 third-party crates in the linked graph plus the -# ten goose workspace crates -- the code-mode and +# (1336 crates vendored, 520 third-party crates in the linked graph plus the +# nine goose workspace crates -- the code-mode and # local-inference branches, and with them v8/candle/llama-cpp, are not built, # and neither is the cuda branch, so the cudaforge git dependency is unused), # then reading "license =" from every vendor-crates/<name>-<version>/Cargo.toml. # Where a crate offers a choice the Apache-2.0 branch is elected, and MIT where # Apache-2.0 is not on offer; both are already named, so no "OR" expression in -# the graph adds an identifier (the ten "Unlicense OR MIT" crates elect MIT, -# adler2 elects Apache-2.0 over 0BSD, ryu elects Apache-2.0 over BSL-1.0, and -# the "Apache-2.0 WITH LLVM-exception" branch of linux-raw-sys/rustix is not -# the one taken). The remaining entries are crates with no choice +# the graph adds an identifier (the seven crates offering Unlicense or MIT +# elect MIT, adler2 elects Apache-2.0 over 0BSD, ryu elects Apache-2.0 over +# BSL-1.0, and the "Apache-2.0 WITH LLVM-exception" branch of +# blake3/linux-raw-sys/rustix is not the one taken). The remaining entries are +# crates with no choice # to make: LGPL-3.0-or-later from ansi_colours (pulled in by bat), # MPL-2.0 from option-ext (via dirs-sys), Unicode-3.0 from the ICU crates and # unicode-ident, CC0-1.0 from the seven bitcoin_hashes/secp256k1 crates (nostr), # CDLA-Permissive-2.0 from the two webpki-roots, ISC from rustls-webpki, # simple_asn1, untrusted and the aws-lc pair (and from ring, "Apache-2.0 AND # ISC"), -# BSD-3-Clause from subtle/brotli/alloc-no-stdlib/exr/lebe plus matchit and the -# three zstd crates, Zlib from foldhash +# BSD-3-Clause from ten crates -- subtle/brotli/encoding_rs/matchit, +# alloc-no-stdlib, alloc-stdlib, the three zstd crates and aws-lc-sys, whose +# multi-licence expression requires it (brotli-decompressor offers it in the +# legacy "BSD-3-Clause/MIT" dual form, where the MIT branch is elected), +# Zlib from foldhash # and zlib-rs, MIT-0 from borrow-or-share, bzip2-1.0.6 from libbz2-rs-sys, and -# MIT from the 170 MIT-only crates. Only zerocopy and zerocopy-derive name -# BSD-2-Clause, and only as the branch of a choice that is not elected, so that -# identifier is held solely by the bundled leaflet.min.js named below. +# MIT from the 132 crates that elect it. +# BSD-2-Clause is elected by no crate -- zerocopy names it only as the branch +# of a choice that is not taken. It comes from the bundled oniguruma instead: +# onig_sys compiles the oniguruma 6.9.10 C sources into the binary while its +# own manifest declares only MIT, and the two-clause BSD terms are in +# vendor-crates/onig_sys-*/oniguruma/COPYING, installed as %%license +# LICENSE.oniguruma. # MPL-2.0 section 3.2 and the LGPL-3.0 source requirement # are satisfied because the complete vendor-crates.tar.zst ships in the src.rpm; # the two texts are additionally installed as %%license files. -# Beside the crates, goose-mcp include_str!()s six minified JavaScript/CSS -# libraries into the binary -- chart.js (MIT), d3 (ISC), d3-sankey +# crates/goose-mcp include_str!()s six minified JavaScript/CSS +# libraries -- chart.js (MIT), d3 (ISC), d3-sankey # (BSD-3-Clause), leaflet (BSD-2-Clause), leaflet.markercluster (MIT) and -# mermaid (MIT). All but leaflet's BSD-2-Clause are already carried above by a -# Rust crate; their texts, which upstream keeps in crates/goose-mcp/licenses/, -# are installed as %%license files. +# mermaid (MIT) -- into the binary, but goose-mcp is a default cargo feature +# and this spec builds with --no-default-features, so that crate is never +# compiled (no "Compiling goose-mcp" in the build log) and none of the six is +# linked into what we ship. Their texts, which upstream keeps in +# crates/goose-mcp/licenses/, still ship as %%license files; every identifier +# they carry is already held above by a Rust crate, so none of them supports an +# entry in the tag. License: Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND CC0-1.0 AND CDLA-Permissive-2.0 AND ISC AND LGPL-3.0-or-later AND MIT AND MIT-0 AND MPL-2.0 AND Unicode-3.0 AND Zlib AND bzip2-1.0.6 URL: https://github.com/aaif-goose/goose Source0: %{name}-%{version}.tar.zst @@ -159,6 +171,10 @@ install -m 0644 vendor-crates/ansi_colours-*/LICENSE LICENSE.ansi_colours install -m 0644 vendor-crates/option-ext-*/LICENSE.txt LICENSE.option-ext +# the bundled oniguruma holds the only BSD-2-Clause in the linked set; the +# onig_sys manifest declares only MIT, so nothing else ships the text +install -m 0644 vendor-crates/onig_sys-*/oniguruma/COPYING LICENSE.oniguruma + %fdupes -s %{buildroot}%{_prefix} %check @@ -177,7 +193,7 @@ fi %files -%license LICENSE LICENSE.ansi_colours LICENSE.option-ext +%license LICENSE LICENSE.ansi_colours LICENSE.oniguruma LICENSE.option-ext %license crates/goose-mcp/licenses/*.license %doc README.md CONTRIBUTING.md %{_bindir}/%{name} ++++++ _service ++++++ --- /var/tmp/diff_new_pack.aBJ2MV/_old 2026-10-05 13:02:54.293043665 +0200 +++ /var/tmp/diff_new_pack.aBJ2MV/_new 2026-10-05 13:02:54.298043875 +0200 @@ -2,7 +2,7 @@ <service name="obs_scm" mode="manual"> <param name="url">https://github.com/aaif-goose/goose.git</param> <param name="scm">git</param> - <param name="revision">v1.52.0</param> + <param name="revision">v1.53.0</param> <param name="match-tag">*</param> <param name="versionformat">@PARENT_TAG@</param> <param name="versionrewrite-pattern">v(\d+\.\d+\.\d+)</param> ++++++ goose-1.52.0.tar.zst -> goose-1.53.0.tar.zst ++++++ /work/SRC/openSUSE:Factory/goose/goose-1.52.0.tar.zst /work/SRC/openSUSE:Factory/.goose.new.3698736/goose-1.53.0.tar.zst differ: char 7, line 1 ++++++ vendor-crates.tar.zst ++++++ /work/SRC/openSUSE:Factory/goose/vendor-crates.tar.zst /work/SRC/openSUSE:Factory/.goose.new.3698736/vendor-crates.tar.zst differ: char 7, line 1
