Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package hawk2 for openSUSE:Factory checked in at 2026-10-16 20:10:41 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/hawk2 (Old) and /work/SRC/openSUSE:Factory/.hawk2.new.3698736 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "hawk2" Fri Oct 16 20:10:41 2026 rev:50 rq:1385187 version:2.7.2+git.1792148770.648dcddb Changes: -------- --- /work/SRC/openSUSE:Factory/hawk2/hawk2.changes 2026-09-17 15:25:40.841735896 +0200 +++ /work/SRC/openSUSE:Factory/.hawk2.new.3698736/hawk2.changes 2026-10-16 20:14:33.814458899 +0200 @@ -1,0 +2,7 @@ +Fri Oct 16 11:19:42 UTC 2026 - Aleksei Burlakov <[email protected]> + +- Update to version 2.7.2+git.1792148770.648dcddb: + * CI/CD: update the make-sle16-compatible.patch correspondingly + * Doc: update sles doc urls + +------------------------------------------------------------------- @@ -31,2 +38,18 @@ -- bump rails stack v8.1.3.1, net-imap v0.6.6 and other gems (bsc#1268996,bsc#1273348, - bsc#1268996,bsc#1275179,bsc#1275183,bsc#1275188,bsc#1275200,bsc#1275213): +- bump rails stack v8.1.3.1, net-imap v0.6.6 and other gems ( + bsc#1268996 VUL-0: CVE-2026-42246: hawk2: net-imap: MITM attacker + can cause Net::IMAP#starttls to return successfully, without starting TLS + bsc#1273348 VUL-0: CVE-2026-66066: hawk2,rubygem-activestorage-8.0, + rubygem-activestorage-5.2: unsafe image processing operations on untrusted + uploads can allow arbitrary file reading and remote code execution + bsc#1275179 VUL-0: CVE-2026-73490: hawk2: loofah: improper handling of SVG + attributes in the HTML5 sanitizer allows bypass of local-reference restrictions + bsc#1275183 VUL-0: CVE-2026-73491: hawk2: loofah: improper + handling of javascript: URIs can lead to XSS + bsc#1275188 VUL-0: CVE-2026-73492: hawk2: loofah: improper + handling of javascript: and vbscript: URIs can lead to XSS + bsc#1275200 VUL-0: CVE-2026-73648: hawk2: rails-html-sanitizer: + cross-site scripting is possible when the sanitizer is configured + to allow certain SVG reference elements + bsc#1275213 VUL-0: CVE-2026-71847: hawk2: json: heap use-after free in + JSON::ResumableParser partial_value can lead to crash on truncated + duplicate-key streams): Old: ---- hawk2-2.7.2+git.1789128469.a738abc1.tar.bz2 New: ---- hawk2-2.7.2+git.1792148770.648dcddb.tar.bz2 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ hawk2.spec ++++++ --- /var/tmp/diff_new_pack.NdJjGS/_old 2026-10-16 20:14:39.216685979 +0200 +++ /var/tmp/diff_new_pack.NdJjGS/_new 2026-10-16 20:14:39.221686190 +0200 @@ -41,7 +41,7 @@ Summary: HA Web Konsole License: GPL-2.0-only Group: %{pkg_group} -Version: 2.7.2+git.1789128469.a738abc1 +Version: 2.7.2+git.1792148770.648dcddb Release: 0 URL: http://www.clusterlabs.org/wiki/Hawk Source: %{name}-%{version}.tar.bz2 ++++++ _servicedata ++++++ --- /var/tmp/diff_new_pack.NdJjGS/_old 2026-10-16 20:14:39.461696278 +0200 +++ /var/tmp/diff_new_pack.NdJjGS/_new 2026-10-16 20:14:39.466696488 +0200 @@ -1,6 +1,6 @@ <servicedata> <service name="tar_scm"> <param name="url">https://github.com/ClusterLabs/hawk.git</param> - <param name="changesrevision">a738abc11e88785956f29936f92b673ad55a6fd7</param></service></servicedata> + <param name="changesrevision">648dcddbbcabd4ba59659cb6f5d07b138fea99b4</param></service></servicedata> (No newline at EOF) ++++++ hawk2-2.7.2+git.1789128469.a738abc1.tar.bz2 -> hawk2-2.7.2+git.1792148770.648dcddb.tar.bz2 ++++++ /work/SRC/openSUSE:Factory/hawk2/hawk2-2.7.2+git.1789128469.a738abc1.tar.bz2 /work/SRC/openSUSE:Factory/.hawk2.new.3698736/hawk2-2.7.2+git.1792148770.648dcddb.tar.bz2 differ: char 11, line 1 ++++++ make-sle16-compatible.patch ++++++ --- /var/tmp/diff_new_pack.NdJjGS/_old 2026-10-16 20:14:39.731707628 +0200 +++ /var/tmp/diff_new_pack.NdJjGS/_new 2026-10-16 20:14:39.737707880 +0200 @@ -1,40 +1,37 @@ -Index: hawk2-2.6.6+git.1734344973.d7058a83/hawk/config/application.rb -=================================================================== +diff --git a/hawk/config/application.rb b/hawk/config/application.rb --- a/hawk/config/application.rb +++ b/hawk/config/application.rb @@ -44,6 +44,11 @@ module Hawk config.middleware.use Rack::Deflater end - + + JsRoutes.setup do |config| + config.module_type = nil + config.namespace = "Routes" + end + - config.x.hawk_is_sles = system("cat /etc/os-release | grep 'ID=.*sles' >/dev/null 2>&1") - - def lookup_daemon_dir -Index: hawk2-2.6.6+git.1734344973.d7058a83/hawk/config/boot.rb -=================================================================== + os_release = File.readable?("/etc/os-release") ? File.read("/etc/os-release") : "" + config.x.hawk_is_sles = os_release[/^ID=["']?([^"'\s]+)["']?$/, 1] == "sles" + config.x.hawk_os_version = os_release[/^VERSION_ID=["']?([^"'\s]+)["']?$/, 1] +diff --git a/hawk/config/boot.rb b/hawk/config/boot.rb --- a/hawk/config/boot.rb +++ b/hawk/config/boot.rb @@ -38,7 +38,7 @@ else gem "virtus", version: "~> 1.0" require "virtus" - + - gem "js-routes", version: ">= 1.3.3" + gem "js-routes", version: ">= 2.0.0" require "js-routes" - + gem "fast_gettext", version: "~> 1.4" -Index: hawk2-2.6.6+git.1734344973.d7058a83/hawk/config/environments/development.rb -=================================================================== +diff --git a/hawk/config/environments/development.rb b/hawk/config/environments/development.rb --- a/hawk/config/environments/development.rb +++ b/hawk/config/environments/development.rb @@ -27,7 +27,7 @@ Rails.application.configure do - + config.cache_store = :memory_store - + - config.assets.debug = true + config.assets.debug = false config.assets.raise_runtime_errors = true
