Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package goose for openSUSE:Factory checked in at 2026-10-31 23:09:36 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/goose (Old) and /work/SRC/openSUSE:Factory/.goose.new.1255 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "goose" Sat Oct 31 23:09:36 2026 rev:13 rq:1394158 version:1.57.0 Changes: -------- --- /work/SRC/openSUSE:Factory/goose/goose.changes 2026-10-27 17:01:27.390874973 +0100 +++ /work/SRC/openSUSE:Factory/.goose.new.1255/goose.changes 2026-10-31 23:12:05.587176807 +0100 @@ -1,0 +2,19 @@ +Sat Oct 31 06:50:00 UTC 2026 - Martin Pluskal <[email protected]> + +- Update to version 1.57.0: + * extension allowlist requires HTTPS and validates redirects, + blocking on policy failure; callers can supply session IDs + * OpenRouter variant suffixes resolve to the base model, vision + lookup uses the catalog provider id, and Databricks sends the + system prompt as system on the MLflow chat route + * scheduled runs use recipe settings, the desktop agent starts + once after a fork, and owned shell process trees die on + cancellation + * zstd 0.14.3 for RUSTSEC advisories and jsonwebtoken removed +- Refresh the vendored dependencies (1097 crates vendored, 482 + third-party crates in the linked set); re-derive the License tag + from the new graph, unchanged at 12 SPDX identifiers +- Bump the bundled(aws-lc) Provides to 5.12.0 with the new + vendoring; libzstd, oniguruma and sqlite3 keep their versions + +------------------------------------------------------------------- Old: ---- goose-1.56.0.tar.zst New: ---- goose-1.57.0.tar.zst ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ goose.spec ++++++ --- /var/tmp/diff_new_pack.a7j0zz/_old 2026-10-31 23:12:14.597550877 +0100 +++ /var/tmp/diff_new_pack.a7j0zz/_new 2026-10-31 23:12:14.600551002 +0100 @@ -18,7 +18,7 @@ %global goose_features aws-providers,otel,rustls-tls,system-keyring,disable-update Name: goose -Version: 1.56.0 +Version: 1.57.0 Release: 0 Summary: Extensible open source AI agent that automates engineering tasks # Legal-Review-Notice: goose itself is Apache-2.0, but the shipped binary @@ -26,7 +26,7 @@ # whole linked set. Derived on this vendoring with # "cargo tree --offline -p goose-cli -e normal --no-default-features # --features %%{goose_features}" over the vendored tree -# (1142 crates vendored, 461 third-party crates in the linked graph plus the +# (1097 crates vendored, 482 third-party crates in the linked graph plus the # nine goose workspace crates -- the code-mode and # local-inference branches, and with them v8/candle/llama-cpp, are not built, # and neither is the cuda branch, so the cudaforge git dependency is unused), @@ -77,6 +77,13 @@ URL: https://github.com/aaif-goose/goose Source0: %{name}-%{version}.tar.zst Source1: vendor-crates.tar.zst +# cargo_vendor runs with filter=true, so crates no Linux target uses are +# emptied at vendor time (the winapi-*/windows_* import libs and wit-bindgen's +# wasm-only objects are gone from the tarball). What is left is test fixtures +# under tests/ dirs, named below. Neither crate is in the linked binary's +# cargo tree except async-compression, and only its test corpus touches it. +# Source-Binary-Exception: vendor-crates.tar.zst:vendor-crates/libloading-*/tests/*.dll -- test-data: fixtures loaded only by libloading's #![cfg(windows)] tests/windows.rs +# Source-Binary-Exception: vendor-crates.tar.zst:vendor-crates/async-compression-*/tests/artifacts/*.zst -- test-data: zstd decode-test corpus (lib.rs.zst needs its dictionary-rust file, long-window-size-lib.rs.zst needs a 2G window); both decode to the crate's own test lib.rs, never executed # PATCH-FIX-OPENSUSE goose-system-libdbus.patch [email protected] -- link the system libdbus instead of the copy bundled in libdbus-sys; not sent upstream because upstream needs the vendored build for its portable/musl binaries Patch0: goose-system-libdbus.patch BuildRequires: cargo @@ -97,7 +104,7 @@ # pkg-config behind a feature/env switch neither sqlx nor bat sets; aws-lc-sys # (pulled in by rustls) has no system-library mode at all. Declare them so the # bundled CVE surface is visible to the distribution. -Provides: bundled(aws-lc) = 5.11.0 +Provides: bundled(aws-lc) = 5.12.0 Provides: bundled(libzstd) = 1.5.7 Provides: bundled(oniguruma) = 6.9.10 Provides: bundled(sqlite3) = 3.51.3 ++++++ _service ++++++ --- /var/tmp/diff_new_pack.a7j0zz/_old 2026-10-31 23:12:14.645552870 +0100 +++ /var/tmp/diff_new_pack.a7j0zz/_new 2026-10-31 23:12:14.648552995 +0100 @@ -2,7 +2,7 @@ <service name="obs_scm" mode="manual"> <param name="url">https://github.com/aaif-goose/goose.git</param> <param name="scm">git</param> - <param name="revision">v1.56.0</param> + <param name="revision">v1.57.0</param> <param name="match-tag">*</param> <param name="versionformat">@PARENT_TAG@</param> <param name="versionrewrite-pattern">v(\d+\.\d+\.\d+)</param> @@ -25,6 +25,9 @@ <param name="src">goose</param> <param name="compression">zst</param> <param name="update">true</param> + <!-- filter=true empties crates no Linux target uses at vendor time + (winapi-*/windows_* import libs, wit-bindgen wasm-only objects) --> + <param name="filter">true</param> <!-- upstream ships a stub crate in vendor/v8, so the vendored crates need a tag to keep them out of its way --> <param name="tag">crates</param> ++++++ goose-1.56.0.tar.zst -> goose-1.57.0.tar.zst ++++++ /work/SRC/openSUSE:Factory/goose/goose-1.56.0.tar.zst /work/SRC/openSUSE:Factory/.goose.new.1255/goose-1.57.0.tar.zst differ: char 7, line 1 ++++++ vendor-crates.tar.zst ++++++ /work/SRC/openSUSE:Factory/goose/vendor-crates.tar.zst /work/SRC/openSUSE:Factory/.goose.new.1255/vendor-crates.tar.zst differ: char 7, line 1
