Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package helm for openSUSE:Factory checked in at 2026-10-28 21:32:04 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/helm (Old) and /work/SRC/openSUSE:Factory/.helm.new.2252680 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "helm" Wed Oct 28 21:32:04 2026 rev:122 rq:1393460 version:4.3.1 Changes: -------- --- /work/SRC/openSUSE:Factory/helm/helm.changes 2026-10-24 22:05:56.923933288 +0200 +++ /work/SRC/openSUSE:Factory/.helm.new.2252680/helm.changes 2026-10-28 21:32:11.919022468 +0100 @@ -1,0 +2,15 @@ +Wed Oct 28 17:50:06 UTC 2026 - Dirk Müller <[email protected]> + +- update vendor.tar to address: + * bsc#1288551, CVE-2026-116591: github.com/klauspost/compress/zstd: + crafted ~27 KB two-block zstd frame makes DecodeAll and the + streaming decoder panic + +------------------------------------------------------------------- +Tue Oct 27 13:51:23 UTC 2026 - Dirk Müller <[email protected]> + +- update vendor.tar: remove + * outdated vendor.tar replacements obsoleted with the 4.3.1 + version update. + +------------------------------------------------------------------- @@ -15 +30,9 @@ -- update to 4.3.1: +- update to 4.3.1 ( + bsc#1287484, CVE-2026-97032: golang.org/x/net/http2: + HTTP/2 server crash due to HPACK encoder race, + bsc#1287128, CVE-2026-78663: golang.org/x/net/http2: + double flow control refund on HTTP/2 server streams, + bsc#1287054, CVE-2026-78660: golang.org/x/net/http2: + HTTP/2 transport accepts malformed framing-related headers + bsc#1286993, CVE-2026-78659: golang.org/x/net/http2: + HTTP/2 server memory exhaustion due to Trailer headers): ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ _service ++++++ --- /var/tmp/diff_new_pack.jk0r7C/_old 2026-10-28 21:32:13.500088037 +0100 +++ /var/tmp/diff_new_pack.jk0r7C/_new 2026-10-28 21:32:13.505088245 +0100 @@ -17,11 +17,9 @@ </service> <service name="go_modules" mode="manual"> <param name="compression">zst</param> - <param name="replace">golang.org/x/crypto=golang.org/x/[email protected]</param> - <param name="replace">golang.org/x/mod=golang.org/x/[email protected]</param> - <param name="replace">golang.org/x/net=golang.org/x/[email protected]</param> <param name="replace">golang.org/x/sys=golang.org/x/[email protected]</param> <param name="replace">google.golang.org/grpc=google.golang.org/[email protected]</param> + <param name="replace">github.com/klauspost/compress=github.com/klauspost/[email protected]</param> </service> </services> ++++++ vendor.tar.zst ++++++ /work/SRC/openSUSE:Factory/helm/vendor.tar.zst /work/SRC/openSUSE:Factory/.helm.new.2252680/vendor.tar.zst differ: char 7, line 1
