Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package perl-Starman for openSUSE:Factory checked in at 2026-10-26 14:17:23 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/perl-Starman (Old) and /work/SRC/openSUSE:Factory/.perl-Starman.new.2252680 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "perl-Starman" Mon Oct 26 14:17:23 2026 rev:6 rq:1392696 version:0.4019 Changes: -------- --- /work/SRC/openSUSE:Factory/perl-Starman/perl-Starman.changes 2026-05-12 19:32:59.654813281 +0200 +++ /work/SRC/openSUSE:Factory/.perl-Starman.new.2252680/perl-Starman.changes 2026-10-26 14:17:24.580633584 +0100 @@ -1,0 +2,48 @@ +Sat Oct 24 09:37:55 UTC 2026 - Tina Müller <[email protected]> + +- updated to 0.4019 + see /usr/share/doc/packages/perl-Starman/Changes + + 0.4019 2026-10-24 02:02:21 PDT + [SECURITY] + - Stream chunked request bodies to the temporary buffer instead of + holding whole chunks in memory (CVE-2026-115824) bsc#1287697 + - Parse chunk-size lines in linear time with a 4 KiB length limit and + strict syntax; malformed lines get 400 (CVE-2026-115822) bsc#1287695 + - Do not send a response body for HEAD requests or 1xx, 204 and 304 + responses, on both the array and streaming paths (CVE-2026-115823) bsc#1287696 + - Limit how long a request body may take to arrive: --read-timeout + (default 5 seconds) now also applies to each wait for more of the + body, and the new --body-timeout option limits the total time + (default 300 seconds; raise it or set it to 0 for slower uploads). + Expiry gets 408 (CVE-2026-115817) bsc#1287694 + - Reject Transfer-Encoding other than "chunked" (400/501) and close + the connection after a request with both Transfer-Encoding and + Content-Length. Completes the fix for CVE-2026-40560 bsc#1263364 + - Reject malformed, negative and conflicting Content-Length headers + with 400 + - Reject malformed header field names: whitespace before the colon, + obs-fold, and Content-Length/Transfer-Encoding spelled with "_" + - Read request bodies with exact framing: keep the bytes after a body + for the next pipelined request, consume chunked trailers (up to + 16 KiB), and reject bodies cut short by EOF with 400 instead of + dispatching a partial body + - Parse each request header exactly once and skip empty lines before + the request line (a request could be dispatched twice with the + pure-Perl HTTP::Parser::XS backend) + - Respond with 500 instead of dispatching a truncated body when the + request body cannot be stored (e.g. disk full) + - Do not send Content-Length or Transfer-Encoding in 1xx and 204 + responses + - Limit request headers to 128 KiB (431) + [BEHAVIOUR CHANGES] + - Requests with Transfer-Encoding in HTTP/1.0, or with obs-fold header + lines, now get 400 + - Pipelined requests of any method are served (previously anything + but GET/HEAD after a request was silently dropped) + - A chunked body must end with the empty line after the last chunk + (RFC 9112); "0\r\n" alone no longer completes the request. Clients + using HTTP::Tiny older than 0.064 (bundled with perl 5.24 and + older) send chunked bodies that way and now get 408 + +------------------------------------------------------------------- Old: ---- Starman-0.4018.tar.gz New: ---- Starman-0.4019.tar.gz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ perl-Starman.spec ++++++ --- /var/tmp/diff_new_pack.YLUeue/_old 2026-10-26 14:17:26.385709108 +0100 +++ /var/tmp/diff_new_pack.YLUeue/_new 2026-10-26 14:17:26.387709191 +0100 @@ -18,7 +18,7 @@ %define cpan_name Starman Name: perl-Starman -Version: 0.4018 +Version: 0.4019 Release: 0 License: Artistic-1.0 OR GPL-1.0-or-later Summary: High-performance preforking PSGI/Plack web server @@ -33,6 +33,7 @@ BuildRequires: perl(HTTP::Date) BuildRequires: perl(HTTP::Parser::XS) BuildRequires: perl(HTTP::Status) +BuildRequires: perl(HTTP::Tiny) >= 0.064 BuildRequires: perl(LWP::UserAgent) BuildRequires: perl(Module::Build) BuildRequires: perl(Module::Build::Tiny) >= 0.34 ++++++ Starman-0.4018.tar.gz -> Starman-0.4019.tar.gz ++++++ ++++ 1662 lines of diff (skipped) ++++++ _scmsync.obsinfo ++++++ --- /var/tmp/diff_new_pack.YLUeue/_old 2026-10-26 14:17:26.565716639 +0100 +++ /var/tmp/diff_new_pack.YLUeue/_new 2026-10-26 14:17:26.568716765 +0100 @@ -1,6 +1,6 @@ -mtime: 1778593732 -commit: c88652e2458a87e07ded1a1bf6e42dc14aee06f3d0182abc04f32724eb7cc597 +mtime: 1793011696 +commit: c53b16a1080ee134435103b12491e2d7bb21f59f602c47cd1afa400e00bf0a27 url: https://src.opensuse.org/perl/perl-Starman -revision: c88652e2458a87e07ded1a1bf6e42dc14aee06f3d0182abc04f32724eb7cc597 +revision: c53b16a1080ee134435103b12491e2d7bb21f59f602c47cd1afa400e00bf0a27 projectscmsync: https://src.opensuse.org/perl/_ObsPrj ++++++ build.specials.obscpio ++++++ ++++++ build.specials.obscpio ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/.gitignore new/.gitignore --- old/.gitignore 1970-01-01 01:00:00.000000000 +0100 +++ new/.gitignore 2026-10-26 11:48:16.000000000 +0100 @@ -0,0 +1 @@ +.osc
