Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package git-bug for openSUSE:Factory checked in at 2026-10-08 11:56:35 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/git-bug (Old) and /work/SRC/openSUSE:Factory/.git-bug.new.3698736 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "git-bug" Thu Oct 8 11:56:35 2026 rev:19 rq:1383104 version:0.11.0 Changes: -------- --- /work/SRC/openSUSE:Factory/git-bug/git-bug.changes 2026-10-03 20:14:39.441425609 +0200 +++ /work/SRC/openSUSE:Factory/.git-bug.new.3698736/git-bug.changes 2026-10-08 11:58:58.734957871 +0200 @@ -1,0 +2,21 @@ +Wed Oct 7 15:16:44 UTC 2026 - Matej Cepl <[email protected]> + +- Update vendored NPM packages to fix CVE-2026-104844: +- Add override for postcss-selector-parser to 7.1.6 to fix quadratic parsing complexity + vulnerability (CVE-2026-104844) +- Regenerate package-lock.json and webui-package.json + +------------------------------------------------------------------- +Tue Oct 6 00:00:00 UTC 2026 - Matej Cepl <[email protected]> + +- Verify v0.11.0 is still the latest upstream release. +- Run govulncheck on the expanded release source with the packaged + vendor tree, both with and without the Web UI build tag. No + reachable vulnerabilities were found. +- GO-2026-5932 is a no-fixed-version module advisory for the + unmaintained golang.org/x/crypto/openpgp package. Upstream uses + ProtonMail's maintained OpenPGP fork; replacing the whole + golang.org/x/crypto module is not applicable because go-git still + needs other x/crypto packages. No replace directives are required. + +------------------------------------------------------------------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ _scmsync.obsinfo ++++++ --- /var/tmp/diff_new_pack.rjJRlA/_old 2026-10-08 11:59:05.145225896 +0200 +++ /var/tmp/diff_new_pack.rjJRlA/_new 2026-10-08 11:59:05.150226105 +0200 @@ -1,5 +1,5 @@ -mtime: 1790364639 -commit: 4918e1e1bf7b46b2e3826b6bd4bafee6f8fca331c7aff42cd84b803466444c8d +mtime: 1791386993 +commit: b1ac3a8689f5cfac43fc5b6186e293d6d49c163ae62bf5b200bb8117716a3dc3 url: https://src.opensuse.org/mcepl/git-bug revision: factory ++++++ _service ++++++ --- /var/tmp/diff_new_pack.rjJRlA/_old 2026-10-08 11:59:05.187227652 +0200 +++ /var/tmp/diff_new_pack.rjJRlA/_new 2026-10-08 11:59:05.191227820 +0200 @@ -14,6 +14,11 @@ </service> <service name="set_version" mode="manual"/ --> <service name="go_modules" mode="manual"> + <!-- v0.11.0 is upstream's latest release. govulncheck reports no + reachable vulnerabilities. GO-2026-5932 has no fixed version + and concerns x/crypto/openpgp, which git-bug replaced with the + maintained ProtonMail fork upstream. Replacing all of x/crypto + would also remove packages (such as ssh) still used by go-git. --> </service> <!-- Traditional osc workflow: archive the npm sources and declare each tarball in the generated spec include. No build-time downloads. --> ++++++ build.specials.obscpio ++++++ ++++++ build.specials.obscpio ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/.gitignore new/.gitignore --- old/.gitignore 1970-01-01 01:00:00.000000000 +0100 +++ new/.gitignore 2026-10-07 17:29:53.000000000 +0200 @@ -0,0 +1,11 @@ +_build.* +build.specials.obscpio +git-bug/ +*.obscpio +!node_modules.obscpio +*.osc +.osc +.pbuild +_scmsync.obsinfo +_service:* +git-bug-*-build/ ++++++ package-lock.json ++++++ --- /var/tmp/diff_new_pack.rjJRlA/_old 2026-10-08 11:59:05.483240029 +0200 +++ /var/tmp/diff_new_pack.rjJRlA/_new 2026-10-08 11:59:05.494240489 +0200 @@ -12425,9 +12425,8 @@ } }, "node_modules/postcss-selector-parser": { - "version": "6.0.10", - "integrity": "sha512-IQ7TZdoaqbT+LCpShg46jnZVlhWD2w6iQYAcYXfHARZ7X1t/UGhhceQDs5X0cGqKvYlHNOuv7Oa1xmb0oQuA3w==", - "dev": true, + "version": "7.1.6", + "integrity": "sha512-7qASPzhKF2l2KLboRZux8CCTRMdGiV08vWmyKzPz22qZ7ZjQBOeY7rNzNoCLSUiftJ7HUq0GERHmxw/t0dCdMw==", "license": "MIT", "dependencies": { "cssesc": "^3.0.0", @@ -13224,18 +13223,6 @@ "node": ">=20.18.1" } }, - "node_modules/shadcn/node_modules/postcss-selector-parser": { - "version": "7.1.6", - "integrity": "sha512-7qASPzhKF2l2KLboRZux8CCTRMdGiV08vWmyKzPz22qZ7ZjQBOeY7rNzNoCLSUiftJ7HUq0GERHmxw/t0dCdMw==", - "license": "MIT", - "dependencies": { - "cssesc": "^3.0.0", - "util-deprecate": "^1.0.2" - }, - "engines": { - "node": ">=4" - } - }, "node_modules/shadcn/node_modules/zod": { "version": "3.25.76", "integrity": "sha512-gzUt/qt81nXsFGKIFcC3YnfEAx5NkunCfnDlvuBSSFS02bcXu4Lmea0AFIUwbLWxWPx3d9p8S5QoaujKcNQxcQ==", ++++++ prepare-webui-lock.py ++++++ --- /var/tmp/diff_new_pack.rjJRlA/_old 2026-10-08 11:59:05.547242705 +0200 +++ /var/tmp/diff_new_pack.rjJRlA/_new 2026-10-08 11:59:05.553242956 +0200 @@ -47,7 +47,8 @@ overrides = lock.get("overrides", {}) if overrides != {"js-yaml@4": "^4.3.2"}: raise Error("Upstream overrides changed; review their npm translation") - result["overrides"] = overrides + result["overrides"] = overrides.copy() + result["overrides"]["postcss-selector-parser"] = "7.1.6" result.pop("pnpm", None) result.pop("packageManager", None) return result ++++++ test_prepare_webui_lock.py ++++++ --- /var/tmp/diff_new_pack.rjJRlA/_old 2026-10-08 11:59:05.627246050 +0200 +++ /var/tmp/diff_new_pack.rjJRlA/_new 2026-10-08 11:59:05.631246217 +0200 @@ -29,7 +29,7 @@ result = HELPER["build_manifest"](package, lock) self.assertEqual(package, before) self.assertEqual(result["dependencies"]["react"], "19.3.0") - self.assertEqual(result["overrides"], {"js-yaml@4": "^4.3.2"}) + self.assertEqual(result["overrides"], {"js-yaml@4": "^4.3.2", "postcss-selector-parser": "7.1.6"}) self.assertNotIn("packageManager", result) self.assertNotIn("pnpm", result) ++++++ webui-lock-report.json ++++++ --- /var/tmp/diff_new_pack.rjJRlA/_old 2026-10-08 11:59:05.656247263 +0200 +++ /var/tmp/diff_new_pack.rjJRlA/_new 2026-10-08 11:59:05.660247430 +0200 @@ -1,6 +1,6 @@ { - "source_identities": 1041, - "installation_entries": 1089, + "source_identities": 1040, + "installation_entries": 1088, "bundled_entries": 6, "not_selected_by_npm": [ "@adobe/[email protected]", @@ -98,6 +98,7 @@ "[email protected]", "[email protected]", "[email protected]", + "[email protected]", "[email protected]", "[email protected]", "[email protected]", ++++++ webui-package.json ++++++ --- /var/tmp/diff_new_pack.rjJRlA/_old 2026-10-08 11:59:05.682248350 +0200 +++ /var/tmp/diff_new_pack.rjJRlA/_new 2026-10-08 11:59:05.688248601 +0200 @@ -90,7 +90,8 @@ "vitest": "4.1.11" }, "overrides": { - "js-yaml@4": "^4.3.2" + "js-yaml@4": "^4.3.2", + "postcss-selector-parser": "7.1.6" } }
