Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package borgbackup for openSUSE:Factory checked in at 2026-10-06 19:19:12 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/borgbackup (Old) and /work/SRC/openSUSE:Factory/.borgbackup.new.3698736 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "borgbackup" Tue Oct 6 19:19:12 2026 rev:57 rq:1382725 version:1.4.5 Changes: -------- --- /work/SRC/openSUSE:Factory/borgbackup/borgbackup.changes 2026-08-27 18:56:20.385024523 +0200 +++ /work/SRC/openSUSE:Factory/.borgbackup.new.3698736/borgbackup.changes 2026-10-06 19:19:13.479573421 +0200 @@ -1,0 +2,9 @@ +Sun Oct 4 17:37:15 UTC 2026 - Bjørn Lie <[email protected]> + +- Add support-msgpack-1_2_3.patch: Support msgpack 1.2.3. msgpack + 1.2.3 brings fixes relevant to borg's usage of the C extension: + memory leaks when map key validation or container hooks fail + (GHSA-j586-36cw-2gc2) and a use-after-free when cleaning up an + incomplete Unpacker.skip(). + +------------------------------------------------------------------- New: ---- support-msgpack-1_2_3.patch ----------(New B)---------- New: - Add support-msgpack-1_2_3.patch: Support msgpack 1.2.3. msgpack 1.2.3 brings fixes relevant to borg's usage of the C extension: ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ borgbackup.spec ++++++ --- /var/tmp/diff_new_pack.Rz3iP2/_old 2026-10-06 19:19:14.188603189 +0200 +++ /var/tmp/diff_new_pack.Rz3iP2/_new 2026-10-06 19:19:14.189603231 +0200 @@ -66,6 +66,8 @@ # python3-guzzle_sphinx_theme isn't available everywhere, # fall back to Sphinx default theme for older distributions Patch0: borgbackup-1.1.4-sphinx-default-theme.patch +# PATCH-FIX-UPSTREAM support-msgpack-1_2_3.patch -- support msgpack 1.2.3 +Patch1: support-msgpack-1_2_3.patch # SECTION build dependencies BuildRequires: bash BuildRequires: %{py3pkg}-Cython >= 3.0.10 @@ -95,10 +97,10 @@ # SECTION runtime and extra requrements # msgpack is not included with borg version >= 1.2.0 anymore # The metadata is very specific about the version, the command will fail if msgpack is out of range -- boo#1198267 -# See https://github.com/borgbackup/borg/blob/1.2.1/setup.py#L68 and update this for every version bump! -BuildRequires: (%{py3pkg}-msgpack >= 1.0.3 with %{py3pkg}-msgpack <= 1.2.1) +# See https://github.com/borgbackup/borg/blob/1.4-maint/pyproject.toml#L39 and update this for every version bump! +BuildRequires: (%{py3pkg}-msgpack >= 1.0.3 with %{py3pkg}-msgpack <= 1.2.3) Requires: %{py3pkg}-packaging -Requires: (%{py3pkg}-msgpack >= 1.0.3 with %{py3pkg}-msgpack <= 1.2.1) +Requires: (%{py3pkg}-msgpack >= 1.0.3 with %{py3pkg}-msgpack <= 1.2.3) %if 0%{?suse_version} > 1500 # upstream recommends a "Requires" if pyfuse3 is available Requires: %{py3pkg}-pyfuse3 >= 3.1.1 @@ -196,6 +198,7 @@ %if ! %{with borg_guzzle} %patch -P 0 -p1 %endif +%patch -P 1 -p1 %ifnarch %ix86 %arm # https://github.com/borgbackup/borg/issues/6996 ++++++ support-msgpack-1_2_3.patch ++++++ >From 084f3fbce66c29334ad0a1d83324011398339547 Mon Sep 17 00:00:00 2001 From: Thomas Waldmann <[email protected]> Date: Tue, 29 Sep 2026 20:03:48 +0200 Subject: [PATCH] support msgpack 1.2.3 msgpack 1.2.3 brings fixes relevant to borg's usage of the C extension: memory leaks when map key validation or container hooks fail (GHSA-j586-36cw-2gc2) and a use-after-free when cleaning up an incomplete Unpacker.skip(). The C Unpacker now raises ValueError when switching between unpack, skip, header readers or read_bytes() while an object is incomplete. borg only uses feed() plus unpack()/iteration (and RobustUnpacker creates a fresh Unpacker on each resync attempt), so this does not affect borg. Co-Authored-By: Claude Opus 5.5 <[email protected]> --- pyproject.toml | 2 +- src/borg/helpers/msgpack.py | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/pyproject.toml b/pyproject.toml index 14751c461d..c5b37836ef 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -36,7 +36,7 @@ dependencies = [ # Please note: # Using any other msgpack version is not supported by Borg development and # any feedback related to issues caused by this will be ignored. - "msgpack >=1.0.3, <=1.2.1", + "msgpack >=1.0.3, <=1.2.3", "packaging", ] diff --git a/src/borg/helpers/msgpack.py b/src/borg/helpers/msgpack.py index 9d3405a307..1bbcdd2312 100644 --- a/src/borg/helpers/msgpack.py +++ b/src/borg/helpers/msgpack.py @@ -145,7 +145,7 @@ def is_supported_msgpack(): version_check = os.environ.get('BORG_MSGPACK_VERSION_CHECK', 'yes').strip().lower() return version_check == 'no' or ( - (1, 0, 3) <= msgpack.version[:3] <= (1, 2, 1) and + (1, 0, 3) <= msgpack.version[:3] <= (1, 2, 3) and msgpack.version not in [] )
