Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package gosec for openSUSE:Factory checked in at 2026-10-27 17:09:07 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/gosec (Old) and /work/SRC/openSUSE:Factory/.gosec.new.2252680 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "gosec" Tue Oct 27 17:09:07 2026 rev:38 rq:1393101 version:2.30.0 Changes: -------- --- /work/SRC/openSUSE:Factory/gosec/gosec.changes 2026-08-26 19:56:59.822678544 +0200 +++ /work/SRC/openSUSE:Factory/.gosec.new.2252680/gosec.changes 2026-10-27 17:10:10.334777616 +0100 @@ -1,0 +2,59 @@ +Tue Oct 27 13:28:50 UTC 2026 - Dirk Müller <[email protected]> + +- Update to version 2.30.0 (bsc#1287590, CVE-2026-97032): + * fix(g602): recognize equality comparison in minimumLenForBranch (#1796) + * fix(G112): honor read timeouts assigned through a struct field (#1798) + * fix(G112): report read timeouts explicitly set to zero (#1797) + * feat(G706): extend log/slog method coverage (#1795) + * fix(autofix): read the first text block of a Claude response (#1794) + * fix(autofix): give every AI request its own timeout (#1793) + * fix(resolve): treat constants from other packages as resolved (#1792) + * fix(autofix): return an error when a Gemini candidate has no content (#1791) + * Update to go version 1.27.3 and 1.26.10 (#1790) + * fix(autofix): default Gemini model to gemini-3.1-pro-preview (#1788) + * fix(G102): resolve concatenated and constant listen addresses (#1787) + * fix: default -concurrency to GOMAXPROCS so container CPU limits apply (#1786) + * fix(g602): track statically known lengths for append results in slice bounds check (#1773) + * feat(rules): add G125 to detect unescaped url.JoinPath elements (#1777) + * fix: load absolute file paths so nested modules are analysed from the parent directory (#1779) + * fix(G118): treat a cancel sent on a channel as handed off (#1782) + * fix(G112): honor read timeouts assigned after the http.Server literal (#1781) + * fix(G303): resolve constant temp file paths (#1784) + * fix(deps): update all dependencies (#1783) + * fix(G203): treat constant template arguments as safe (#1770) + * fix(G402): check TLS settings assigned through a *tls.Config (#1769) + * fix(deps): update all dependencies (#1775) + * Update to go version 1.27.2 and 1.26.9 (#1772) + * Keep SARIF driver rules sorted and resolve rule indexes at the end (#1767) + * fix(G602): track append() results for slice bounds checking (#1754) + * fix(deps): update all dependencies (#1768) + * fix(G602): trust len(nilSlice) == N guards, matching make()-backed slices (#1752) + * fix(G407): treat an array IV/nonce as a zeroed buffer (#1763) + * fix(fileperms): resolve constant file and directory permissions (#1766) + * fix(G102): detect binding to the IPv6 unspecified address (#1760) + * fix(G407): stop the nonce source walk on cycles (#1761) + * fix(G407): do not count AEAD.Seal as the read that fills its own nonce (#1762) + * fix(deps): update all dependencies (#1764) + * fix(G602): validate inequality len guards (#1757) + * fix(G121): track request captured by closures (#1759) + * fix(deps): update all dependencies (#1756) + * fix: make nosec suppression independent of comment order (#1741) + * fix(G403): resolve constant RSA key sizes (#1751) + * fix(G602): validate subslice bounds under equality guards (#1749) + * fix(G124): resolve negated constant cookie flags (#1748) + * fix(G602): report constant index equal to the length asserted by an equality guard (#1746) + * Skip taint call graphs when no sinks match (#1745) + * Fix brittle test for html writer (#1744) + * fix(G404): ignore non-cryptographic Shuffle calls (#1742) + * fix(deps): update all dependencies (#1743) + * fix(taint): remove Result.Source field that is never populated (#1739) + * Update all dependencies (#1737) + * Update go version 1.27.1 and 1.26.8 and phased out 1.25 (#1738) + * fix(report): correct Babel SRI hash (#1736) + * fix(taint): make wide caller traversal deterministic (#1733) + * fix(G702): skip the context argument of exec.CommandContext (#1730) + * feat(taint): name the sink in taint finding messages (#1731) + * Update all dependencies (#1734) + * Update action to gosec version 2.29.0 (#1728) + +------------------------------------------------------------------- Old: ---- gosec-2.29.0.obscpio New: ---- gosec-2.30.0.obscpio ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ gosec.spec ++++++ --- /var/tmp/diff_new_pack.Q0nLXF/_old 2026-10-27 17:10:13.002889376 +0100 +++ /var/tmp/diff_new_pack.Q0nLXF/_new 2026-10-27 17:10:13.006889544 +0100 @@ -1,7 +1,7 @@ # # spec file for package gosec # -# Copyright (c) 2025 SUSE LLC +# Copyright (c) 2026 SUSE LLC and contributors # # All modifications and additions to the file contributed by third parties # remain the property of their copyright owners, unless otherwise agreed @@ -17,7 +17,7 @@ Name: gosec -Version: 2.29.0 +Version: 2.30.0 Release: 0 Summary: CLI tool to scan the Go AST and SSA code representations for security problems License: Apache-2.0 ++++++ _service ++++++ --- /var/tmp/diff_new_pack.Q0nLXF/_old 2026-10-27 17:10:13.078892560 +0100 +++ /var/tmp/diff_new_pack.Q0nLXF/_new 2026-10-27 17:10:13.086892895 +0100 @@ -4,8 +4,8 @@ <param name="filename">gosec</param> <param name="url">https://github.com/securego/gosec.git</param> <param name="scm">git</param> - <param name="revision">v2.29.0</param> - <param name="match-tag">v*</param> + <param name="revision">v2.30.0</param> + <param name="match-tag">v*</param> <param name="versionformat">@PARENT_TAG@</param> <param name="versionrewrite-pattern">v(.*)</param> <param name="versionrewrite-replacement">\1</param> ++++++ _servicedata ++++++ --- /var/tmp/diff_new_pack.Q0nLXF/_old 2026-10-27 17:10:13.146895408 +0100 +++ /var/tmp/diff_new_pack.Q0nLXF/_new 2026-10-27 17:10:13.155895785 +0100 @@ -1,6 +1,6 @@ <servicedata> <service name="tar_scm"> <param name="url">https://github.com/securego/gosec.git</param> - <param name="changesrevision">deb54465fea23d19a77f037e11e6589021f8501d</param></service></servicedata> + <param name="changesrevision">5eb1d104ef85ff2c905c877eb600e8c1dee33a22</param></service></servicedata> (No newline at EOF) ++++++ gosec-2.29.0.obscpio -> gosec-2.30.0.obscpio ++++++ ++++ 7219 lines of diff (skipped) ++++++ gosec.obsinfo ++++++ --- /var/tmp/diff_new_pack.Q0nLXF/_old 2026-10-27 17:10:13.647916395 +0100 +++ /var/tmp/diff_new_pack.Q0nLXF/_new 2026-10-27 17:10:13.658916855 +0100 @@ -1,5 +1,5 @@ name: gosec -version: 2.29.0 -mtime: 1787647058 -commit: deb54465fea23d19a77f037e11e6589021f8501d +version: 2.30.0 +mtime: 1792746443 +commit: 5eb1d104ef85ff2c905c877eb600e8c1dee33a22 ++++++ vendor.tar.xz ++++++ ++++ 297041 lines of diff (skipped)
