Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package nghttp2 for openSUSE:Factory checked in at 2026-08-01 18:28:36 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/nghttp2 (Old) and /work/SRC/openSUSE:Factory/.nghttp2.new.16738 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "nghttp2" Sat Aug 1 18:28:36 2026 rev:92 rq:1368786 version:1.70.0 Changes: -------- --- /work/SRC/openSUSE:Factory/nghttp2/nghttp2.changes 2026-06-30 15:11:55.984994303 +0200 +++ /work/SRC/openSUSE:Factory/.nghttp2.new.16738/nghttp2.changes 2026-08-01 18:29:23.427895046 +0200 @@ -1,0 +2,33 @@ +Fri Jul 31 08:15:24 UTC 2026 - Martin Pluskal <[email protected]> + +- Require the versions configure actually checks for: libnghttp3 >= 1.17.0 + and libngtcp2 >= 1.23.0. Without them OBS starts the build and lets it + fail in configure, instead of holding the package unresolvable until + nghttp3 is in place + +------------------------------------------------------------------- +Fri Jul 31 06:47:45 UTC 2026 - Martin Pluskal <[email protected]> + +- Update to 1.70.0: + * nghttpx: add separate frontend and backend stream timeouts, plus an + HTTP/2 stream write timeout + * nghttpx: drop HTTP/2 and HTTP/3 connections whose frontend write + rate is too low, so a peer can no longer hold a connection open by + reading slowly + * Rework HTTP header validation, and add the value check that was + missing for the priority header field + * Fix an out-of-bounds read in the base64 decoder + * get_socket_error() now reports the errno of getsockopt() when that + call itself fails, instead of a stale value + * Update the bundled llhttp to 9.4.2 and mruby to 4.0.0, and refresh + the bundled ngtcp2, neverbleed and sfparse + * Large internal rework: nghttpx now carries its error paths in + std::expected rather than out-parameters +- Drop 0001-nghttpx-Tighten-up-CONNECT-and-HTTP-Upgrade-handling.patch, + the fix is part of this release (CVE-2026-58055, bsc#1269489) +- Mark the doc subpackage noarch, it ships documentation only and + rpmlint rightly flagged it with no-binary +- Run spec-cleaner: drop the Group tags and sort the build + dependencies + +------------------------------------------------------------------- Old: ---- 0001-nghttpx-Tighten-up-CONNECT-and-HTTP-Upgrade-handling.patch nghttp2-1.69.0.tar.xz nghttp2-1.69.0.tar.xz.asc New: ---- nghttp2-1.70.0.tar.xz nghttp2-1.70.0.tar.xz.asc ----------(Old B)---------- Old: std::expected rather than out-parameters - Drop 0001-nghttpx-Tighten-up-CONNECT-and-HTTP-Upgrade-handling.patch, the fix is part of this release (CVE-2026-58055, bsc#1269489) ----------(Old E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ nghttp2.spec ++++++ --- /var/tmp/diff_new_pack.lVcBV4/_old 2026-08-01 18:29:24.195921212 +0200 +++ /var/tmp/diff_new_pack.lVcBV4/_new 2026-08-01 18:29:24.199921348 +0200 @@ -24,20 +24,19 @@ %bcond_with http3 %endif Name: nghttp2 -Version: 1.69.0 +Version: 1.70.0 Release: 0 Summary: Implementation of Hypertext Transfer Protocol version 2 in C License: MIT -Group: Development/Libraries/C and C++ URL: https://nghttp2.org/ Source0: https://github.com/nghttp2/nghttp2/releases/download/v%{version}/nghttp2-%{version}.tar.xz Source1: https://github.com/nghttp2/nghttp2/releases/download/v%{version}/nghttp2-%{version}.tar.xz.asc Source2: nghttp2.keyring Source3: baselibs.conf -# PATCH-FIX-UPSTREAM: CVE-2026-58055 -Patch: 0001-nghttpx-Tighten-up-CONNECT-and-HTTP-Upgrade-handling.patch BuildRequires: libboost_thread-devel BuildRequires: pkgconfig +# for util/test_util_localtime_date +BuildRequires: timezone BuildRequires: pkgconfig(cunit) BuildRequires: pkgconfig(jansson) BuildRequires: pkgconfig(libcares) @@ -53,15 +52,13 @@ BuildRequires: gcc-c++ %endif %if %{with http3} +BuildRequires: libngtcp2_crypto_ossl-devel >= 1.23.0 BuildRequires: pkgconfig(libevent_openssl) -BuildRequires: pkgconfig(libnghttp3) -BuildRequires: libngtcp2_crypto_ossl-devel +BuildRequires: pkgconfig(libnghttp3) >= 1.17.0 %endif %ifnarch ppc %{arm} BuildRequires: pkgconfig(jemalloc) %endif -# for util/test_util_localtime_date -BuildRequires: timezone %description This is an implementation of Hypertext Transfer Protocol version 2. @@ -74,7 +71,6 @@ %package -n %{soname}-%{sover} Summary: Shared library for nghttp2 -Group: System/Libraries %description -n %{soname}-%{sover} Shared C libraries for implementation of Hypertext Transfer Protocol @@ -82,7 +78,6 @@ %package -n python3-nghttp2 Summary: Python3 bindings for nghttp2 -Group: Development/Libraries/Python %description -n python3-nghttp2 Python bindings for implementation of Hypertext Transfer Protocol version @@ -90,7 +85,6 @@ %package -n %{soname}-devel Summary: Development files for nghttp2 -Group: Development/Languages/C and C++ Requires: %{soname}-%{sover} = %{version} Provides: %{name}-devel = %{version} @@ -100,7 +94,7 @@ %package doc Summary: Documentation for nghttp2 -Group: Documentation/HTML +BuildArch: noarch %description doc Documentation for nghttp2, which includes a shared C library, ++++++ nghttp2-1.69.0.tar.xz -> nghttp2-1.70.0.tar.xz ++++++ ++++ 181958 lines of diff (skipped)
