Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package github-mcp-server for openSUSE:Factory checked in at 2026-10-27 16:59:04 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/github-mcp-server (Old) and /work/SRC/openSUSE:Factory/.github-mcp-server.new.2252680 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "github-mcp-server" Tue Oct 27 16:59:04 2026 rev:14 rq:1392928 version:2.0.3 Changes: -------- --- /work/SRC/openSUSE:Factory/github-mcp-server/github-mcp-server.changes 2026-10-09 21:45:55.530686732 +0200 +++ /work/SRC/openSUSE:Factory/.github-mcp-server.new.2252680/github-mcp-server.changes 2026-10-27 16:59:36.783243023 +0100 @@ -1,0 +2,17 @@ +Thu Oct 22 10:06:54 UTC 2026 - Martin Pluskal <[email protected]> + +- Update to version 2.0.3: + * Build with Go 1.27.3, whose crypto/x509 rejects certificate + chains using the compromised eMudhra intermediates + (CVE-2026-111943, boo#1286317) + * Fix UTF-8 encoding in repository resource URIs + * get_file_contents returns a resource link for files over 1 MB + * Cursor pagination for the list_label tool + * No new or renamed tools +- Vendored Go modules are unchanged since 2.0.2 (module set + identical): only MIT, BSD-3-Clause and Apache-2.0, no copyleft, + so the licence audit stands +- go.mod now requires go 1.27.3, so raise the golang(API) floor to + >= 1.27 (the go command enforces the patch level at build time) + +------------------------------------------------------------------- Old: ---- github-mcp-server-2.0.2.tar.zst New: ---- github-mcp-server-2.0.3.tar.zst ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ github-mcp-server.spec ++++++ --- /var/tmp/diff_new_pack.rA4lq3/_old 2026-10-27 16:59:37.671280212 +0100 +++ /var/tmp/diff_new_pack.rA4lq3/_new 2026-10-27 16:59:37.674280337 +0100 @@ -23,7 +23,7 @@ # -modcacherw leave the module cache writable so cleanup cannot fail %define goflags "-buildmode=pie -mod=vendor -modcacherw" Name: github-mcp-server -Version: 2.0.2 +Version: 2.0.3 Release: 0 Summary: Model Context Protocol server for GitHub License: MIT @@ -31,14 +31,17 @@ Source0: %{name}-%{version}.tar.zst Source1: vendor.tar.zst # cgo stays enabled so -buildmode=pie links through the system linker, which is -# what emits the GNU build-id that debuginfo extraction needs. go1.26 pulls gcc +# what emits the GNU build-id that debuginfo extraction needs. go1.27 pulls gcc # in transitively, but this package depends on it directly, so say so. BuildRequires: gcc -# go.mod declares "go 1.26.8". Go refuses to build a module that asks for a +# go.mod declares "go 1.27.3". Go refuses to build a module that asks for a # newer patch level than the toolchain provides and toolchain auto-download is -# unavailable offline, so the floor has to track the directive exactly: a plain -# ">= 1.26" would admit 1.26.0, which is older than 1.26.8 and fails to build. -BuildRequires: golang(API) >= 1.26.8 +# unavailable offline, so the floor has to track the directive's minor line: +# a plain ">= 1.27" admits 1.27.0, which is older than 1.27.3 and fails to +# build. (The golang(API) virtual only carries major.minor, so ">= 1.27.3" is +# not expressible; the go command itself enforces the patch level at build +# time.) Keep this in sync with go.mod on every bump. +BuildRequires: golang(API) >= 1.27 BuildRequires: zstd # Only used for the optional OAuth browser flow (internal/oauth/env.go shells # out to xdg-open); the token-based path needs nothing external. ++++++ _service ++++++ --- /var/tmp/diff_new_pack.rA4lq3/_old 2026-10-27 16:59:37.723282389 +0100 +++ /var/tmp/diff_new_pack.rA4lq3/_new 2026-10-27 16:59:37.727282557 +0100 @@ -3,8 +3,8 @@ <param name="url">https://github.com/github/github-mcp-server</param> <param name="scm">git</param> <param name="exclude">.git</param> - <param name="revision">v2.0.2</param> - <param name="version">2.0.2</param> + <param name="revision">v2.0.3</param> + <param name="version">2.0.3</param> <param name="changesgenerate">disable</param> </service> <service name="recompress" mode="manual"> @@ -13,7 +13,7 @@ </service> <service name="go_modules" mode="manual"> <param name="compression">zst</param> - <param name="archive">github-mcp-server-2.0.2.tar.zst</param> + <param name="archive">github-mcp-server-2.0.3.tar.zst</param> </service> </services> ++++++ github-mcp-server-2.0.2.tar.zst -> github-mcp-server-2.0.3.tar.zst ++++++ ++++ 1725 lines of diff (skipped) ++++++ vendor.tar.zst ++++++
