Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package gleam for openSUSE:Factory checked in at 2026-11-06 19:57:49 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/gleam (Old) and /work/SRC/openSUSE:Factory/.gleam.new.3759290 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "gleam" Fri Nov 6 19:57:49 2026 rev:19 rq:1395795 version:1.19.2 Changes: -------- --- /work/SRC/openSUSE:Factory/gleam/gleam.changes 2026-08-06 16:27:21.147229862 +0200 +++ /work/SRC/openSUSE:Factory/.gleam.new.3759290/gleam.changes 2026-11-06 20:04:19.414203585 +0100 @@ -1,0 +2,33 @@ +Tue Oct 27 12:53:07 UTC 2026 - Jan Fooken <[email protected]> + +- CVE-2026-115905, CVE-2026-115906, CVE-2026-115907, + CVE-2026-115908, CVE-2026-115909: Update zip crate to fix several + security vulnerabilities (bsc#1287931) + * Add patch fix-for-CVE-2026-115905.patch + +------------------------------------------------------------------- +Thu Oct 22 09:54:02 UTC 2026 - Jan Fooken <[email protected]> + +- Update to 1.19.2: + * CVE-2026-103061: arbitrary directory deletion via path + traversal in package metadata (bsc#1285067) + * Set minimum required Erlang version to 27 + * All features and bug fixes are extensively highlighted with + examples in upstream's blog post at + https://gleam.run/news/gleam-doesnt-compile-to-erlang-source-anymore/ + and changelogs at + https://github.com/gleam-lang/gleam/blob/v1.19.0/CHANGELOG.md & + https://github.com/gleam-lang/gleam/blob/v1.19.1/CHANGELOG.md & + https://github.com/gleam-lang/gleam/blob/v1.19.2/CHANGELOG.md . + Some of the highlights include: + - Gleam can now generate Erlang abstract forms, making the + compilation much faster. + - JavaScript code generation optimization including pattern + matching. + - The --src-only flag has been renamed to --no-dev. + - Improved error messages. + - Smaller binary build cache. + - Compiling for BEAM targets not creates .app files. + - It gained the ability to specify OTP application names. + +------------------------------------------------------------------- Old: ---- gleam-1.18.1.tar.zst New: ---- fix-for-CVE-2026-115905.patch gleam-1.19.2.tar.zst ----------(New B)---------- New: security vulnerabilities (bsc#1287931) * Add patch fix-for-CVE-2026-115905.patch ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ gleam.spec ++++++ --- /var/tmp/diff_new_pack.JTgeJD/_old 2026-11-06 20:04:25.260448413 +0100 +++ /var/tmp/diff_new_pack.JTgeJD/_new 2026-11-06 20:04:25.264448580 +0100 @@ -17,21 +17,23 @@ Name: gleam -Version: 1.18.1 +Version: 1.19.2 Release: 0 Summary: A friendly language for building type-safe, scalable systems! License: Apache-2.0 URL: https://gleam.run/ Source0: %{name}-%{version}.tar.zst Source1: vendor.tar.zst +# PATCH-FIX-OPENSUSE fix-for-CVE-2026-115905.patch bsc#1287931 GHSA-wjr6-mhvj-cjvm GHSA-gmfj-vffv-32pw [email protected] -- Update zip crate due to several security issues +Patch1: fix-for-CVE-2026-115905.patch BuildRequires: cargo-packaging # Gleam depends on the duration_constructors feature # https://github.com/rust-lang/rust/issues/120301 BuildRequires: cargo >= 1.91.0 # For tests -BuildRequires: erlang >= 26 +BuildRequires: erlang >= 27 BuildRequires: git-core -Requires: erlang >= 26 +Requires: erlang >= 27 Requires: erlang-rebar3 ExclusiveArch: %{rust_tier1_arches} @@ -51,11 +53,28 @@ install -m 0755 %{_builddir}/%{name}-%{version}/target/release/gleam %{buildroot}%{_bindir}/gleam %check -# tests::echo requires JavaScript engines that aren't packaged on openSUSE +# tests::echo* requires JavaScript engines that aren't packaged on openSUSE # tests::escript_success_with_dependency requires network access # tests::all_files_have_copyright_notice has a bug where id doesn't handle gleam.lock files %{cargo_test} -- \ --skip tests::echo \ + --skip tests::output::echo_bitarray \ + --skip tests::output::echo_bool \ + --skip tests::output::echo_charlist \ + --skip tests::output::echo_circular_reference \ + --skip tests::output::echo_custom_type \ + --skip tests::output::echo_dict \ + --skip tests::output::echo_float \ + --skip tests::output::echo_function \ + --skip tests::output::echo_importing_module_named_inspect \ + --skip tests::output::echo_int \ + --skip tests::output::echo_list \ + --skip tests::output::echo_nan_infinity \ + --skip tests::output::echo_nil \ + --skip tests::output::echo_singleton \ + --skip tests::output::echo_string \ + --skip tests::output::echo_tuple \ + --skip tests::output::echo_with_message \ --skip tests::escript_success_with_dependency \ --skip tests::all_files_have_copyright_notice ++++++ _scmsync.obsinfo ++++++ --- /var/tmp/diff_new_pack.JTgeJD/_old 2026-11-06 20:04:25.337451638 +0100 +++ /var/tmp/diff_new_pack.JTgeJD/_new 2026-11-06 20:04:25.346452014 +0100 @@ -1,6 +1,6 @@ -mtime: 1785850868 -commit: 793fa87d203658b0133604b59235f857e89d61a1e0e0cf41632e953e0baba2b5 +mtime: 1793625123 +commit: 0097e31ecf903707e325edbef2ac0e650b7ba010327273407557d293a2be28dd url: https://src.opensuse.org/erlang/gleam -revision: 793fa87d203658b0133604b59235f857e89d61a1e0e0cf41632e953e0baba2b5 +revision: 0097e31ecf903707e325edbef2ac0e650b7ba010327273407557d293a2be28dd projectscmsync: https://src.opensuse.org/erlang/_ObsPrj.git ++++++ _service ++++++ --- /var/tmp/diff_new_pack.JTgeJD/_old 2026-11-06 20:04:25.397454150 +0100 +++ /var/tmp/diff_new_pack.JTgeJD/_new 2026-11-06 20:04:25.407454569 +0100 @@ -3,7 +3,7 @@ <param name="url">https://github.com/gleam-lang/gleam.git</param> <param name="versionformat">@PARENT_TAG@</param> <param name="scm">git</param> - <param name="revision">v1.18.1</param> + <param name="revision">v1.19.2</param> <param name="match-tag">*</param> <param name="versionrewrite-pattern">v(\d+\.\d+\.\d+)</param> <param name="versionrewrite-replacement">\1</param> @@ -17,7 +17,7 @@ <service name="cargo_vendor" mode="manual"> <param name="src">gleam</param> <param name="compression">zst</param> - <param name="update">false</param> + <param name="update">true</param> </service> </services> ++++++ build.specials.obscpio ++++++ --- old/.gitignore 2026-08-04 15:41:08.000000000 +0200 +++ new/.gitignore 2026-11-02 14:12:03.000000000 +0100 @@ -2,3 +2,4 @@ /*.obscpio /*.obsinfo /gleam/ +/gleam-*-build/ ++++++ build.specials.obscpio ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/.gitignore new/.gitignore --- old/.gitignore 1970-01-01 01:00:00.000000000 +0100 +++ new/.gitignore 2026-11-02 14:12:03.000000000 +0100 @@ -0,0 +1,5 @@ +/*.osc +/*.obscpio +/*.obsinfo +/gleam/ +/gleam-*-build/ ++++++ fix-for-CVE-2026-115905.patch ++++++ From: Jan Fooken <[email protected]> Date: 2026-10-27 14:21:33 +0000 Subject: Update zip crate due to several security issues References: bsc#1287931 GHSA-wjr6-mhvj-cjvm GHSA-gmfj-vffv-32pw Upstream: never The zip crate prior to version 9.0.5 is affected by the following CVEs: * CVE-2026-115905 * CVE-2026-115906 * CVE-2026-115907 * CVE-2026-115908 * CVE-2026-115909 Versions prior to 9.1.0 are affected by the following relevant GitHub security advisories: * GHSA-wjr6-mhvj-cjvm * GHSA-gmfj-vffv-32pw Index: gleam-1.17.0/compiler-cli/Cargo.toml =================================================================== --- gleam-1.17.0.orig/compiler-cli/Cargo.toml +++ gleam-1.17.0/compiler-cli/Cargo.toml @@ -34,7 +34,7 @@ fslock = "0" # Provides a way to determine if two files are the same using filesystem node ids same-file = "1" # Creation of zip files -zip = { version = "8", features = ["deflate"], default-features = false } +zip = { version = "9.1.0", features = ["deflate"], default-features = false } async-trait.workspace = true base16.workspace = true Index: gleam-1.17.0/compiler-cli/src/fs.rs =================================================================== --- gleam-1.17.0.orig/compiler-cli/src/fs.rs +++ gleam-1.17.0/compiler-cli/src/fs.rs @@ -866,7 +866,7 @@ impl<W: Write + io::Seek> ZipArchive<W> Ok(()) } - fn options(&self) -> zip::write::FileOptions<'static, ()> { + fn options(&self) -> zip::write::FileOptions<'static, 'static, ()> { zip::write::SimpleFileOptions::default() } } ++++++ gleam-1.18.1.tar.zst -> gleam-1.19.2.tar.zst ++++++ ++++ 71720 lines of diff (skipped) ++++++ vendor.tar.zst ++++++ /work/SRC/openSUSE:Factory/gleam/vendor.tar.zst /work/SRC/openSUSE:Factory/.gleam.new.3759290/vendor.tar.zst differ: char 7, line 1
