Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package openai-codex for openSUSE:Factory checked in at 2026-11-08 19:21:51 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/openai-codex (Old) and /work/SRC/openSUSE:Factory/.openai-codex.new.3759290 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "openai-codex" Sun Nov 8 19:21:51 2026 rev:27 rq:1396092 version:0.166.0 Changes: -------- --- /work/SRC/openSUSE:Factory/openai-codex/openai-codex.changes 2026-11-07 23:32:47.273980622 +0100 +++ /work/SRC/openSUSE:Factory/.openai-codex.new.3759290/openai-codex.changes 2026-11-08 19:22:11.865407136 +0100 @@ -1,0 +2,7 @@ +Sat Nov 7 19:20:39 UTC 2026 - Martin Pluskal <[email protected]> + +- Re-vendor with zip 9.0.0 -> 9.0.5 (boo#1287915, + CVE-2026-115905): fixed zip line, plus its lockstep lzma-rust2, + constant_time_eq and zstd knock-ons. No upstream version change. + +------------------------------------------------------------------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ openai-codex.spec ++++++ --- /var/tmp/diff_new_pack.5a0Fjf/_old 2026-11-08 19:22:16.475597850 +0100 +++ /var/tmp/diff_new_pack.5a0Fjf/_new 2026-11-08 19:22:16.476597891 +0100 @@ -90,6 +90,16 @@ # Apache-2.0") elect Apache-2.0. Upstream's own gix move (0.81.0 -> # 0.89.0, gix-pack 0.68.0 -> 0.76.0) retires the boo#1285151 backport: # codex-bump-gix-0.88.patch and codex-gix-error-anyhow.patch are dropped. +# - Re-vendor (no upstream bump): zip 9.0.0 -> 9.0.5 (boo#1287915). +# - Knock-ons: lzma-rust2 0.21.0 -> 0.22.0, constant_time_eq gains 0.6.1, +# zstd 0.13.3 -> 0.14.3. +# - zstd-safe 7.2.4 -> 8.2.0, zstd-sys unified on 2.1.2 (system libzstd for +# both closures, verified by the %install DT_NEEDED assertion). +# - Re-derived scope: 777 third-party crates (776 tallied, aws-lc-sys +# itemised separately as before). +# - Tally: Apache-2.0 542, MIT 178, Unicode-3.0 20, MPL-2.0 12, ISC 9, +# BSD-3-Clause 12, Zlib 5, BSD-2-Clause 1, CC0-1.0 1. +# - Tally: CDLA-Permissive-2.0 1, bzip2-1.0.6 1; License: tag unchanged. # - self_cell 1.2.2 is "Apache-2.0 OR GPL-2.0-only" and is the ONLY crate # anywhere in the graph offering GPL. Apache-2.0 is elected, so this # package carries no GPL obligation; please do not re-derive it as GPL. ++++++ vendor.tar.zst ++++++ /work/SRC/openSUSE:Factory/openai-codex/vendor.tar.zst /work/SRC/openSUSE:Factory/.openai-codex.new.3759290/vendor.tar.zst differ: char 5, line 1
