Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package glab for openSUSE:Factory checked in at 2026-08-19 17:57:19 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/glab (Old) and /work/SRC/openSUSE:Factory/.glab.new.1258 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "glab" Wed Aug 19 17:57:19 2026 rev:93 rq:1371797 version:1.114.0 Changes: -------- --- /work/SRC/openSUSE:Factory/glab/glab.changes 2026-08-12 16:13:52.433934905 +0200 +++ /work/SRC/openSUSE:Factory/.glab.new.1258/glab.changes 2026-08-19 17:57:32.055305007 +0200 @@ -1,0 +2,38 @@ +Tue Aug 18 13:57:11 UTC 2026 - Pavel Dostál <[email protected]> + +- Update to version 1.114.0: + * feat(api): support dynamic custom headers for authenticating proxies + * feat(artifact-registry): add glab artifact-registry login --docker + * feat(artifact-registry): resolve artifact registries in the Docker + credential helper + * feat(mr): show source and target branches in view + * feat(update): detect more install methods for the upgrade nudge + * fix(cmdutils): resolve same-host SSH remotes to the right account + * fix(config): resolve YAML alias nodes in hosts config + * fix(git): detect "no git repository" by exit status, not message text + * fix: glab can not set group level variable masked or masked and hidden +- Rebase glab-disable_update_check.patch for 1.114.0 and restore the + actual disabling effect: upstream moved the check_update default out + of internal/config/config.yaml.lock/config_stub.go (removed from the + source tree) into a internal/config/schema.go KeyDef table, which the + last rebase (1.102.0) missed updating - so glab has been shipping with + update checks NOT actually disabled since 1.102.0. Flip that KeyDef's + Default to "false" instead. + +------------------------------------------------------------------- +Mon Aug 17 07:04:55 UTC 2026 - Pavel Dostál <[email protected]> + +- Add glab-CVE-2026-39821-idna-punycode.patch: reject all-ASCII xn-- + Punycode labels in the vendored golang.org/x/net/idna package + regardless of Go's unicode.Version (boo#1266614, CVE-2026-39821). + Bumping the vendored x/net version alone does not fix this, as the + upstream check is gated behind unicode.Version >= 16.0.0, which our + Go toolchain does not yet report. +- The remaining open VUL bugs against glab are already fixed by the + currently vendored dependency versions (x/net 0.56.0, x/crypto + 0.54.0, go-retryablehttp 0.7.8), all above each CVE's fixed version + per the Go vulnerability database: boo#1235353, boo#1241815, + boo#1251467, boo#1251685, boo#1265775, boo#1265832, boo#1266172, + boo#1267155, boo#1227037. + +------------------------------------------------------------------- Old: ---- glab-1.113.0.obscpio New: ---- glab-1.114.0.obscpio glab-CVE-2026-39821-idna-punycode.patch ----------(New B)---------- New: - Add glab-CVE-2026-39821-idna-punycode.patch: reject all-ASCII xn-- Punycode labels in the vendored golang.org/x/net/idna package ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ glab.spec ++++++ --- /var/tmp/diff_new_pack.5MpHoS/_old 2026-08-19 17:57:34.430390188 +0200 +++ /var/tmp/diff_new_pack.5MpHoS/_new 2026-08-19 17:57:34.431390224 +0200 @@ -18,16 +18,23 @@ Name: glab -Version: 1.113.0 +Version: 1.114.0 Release: 0 Summary: A GitLab command line tool License: MIT -Group: Development/Tools/Other URL: https://gitlab.com/gitlab-org/cli Source0: %{name}-%{version}.tar.gz Source1: vendor.tar.gz # https://sources.debian.org/src/glab/1.49.0-1/debian/patches/0001-Disable-update-check.patch Patch0: glab-disable_update_check.patch +# PATCH-FIX-UPSTREAM glab-CVE-2026-39821-idna-punycode.patch boo#1266614 [email protected] +# Backport of golang.org/x/net commit f05f21be5927155a88b371674c298ada54b71cf5: +# reject all-ASCII xn-- Punycode labels regardless of Go's unicode.Version. +Patch1: glab-CVE-2026-39821-idna-punycode.patch +BuildRequires: bash-completion +BuildRequires: fish +BuildRequires: zsh +Suggests: glab-doc %if 0%{?fedora_version} || 0%{?rhel_version} || 0%{?centos_version} || 0%{?almalinux_version} || 0%{?rocky_version} BuildRequires: git BuildRequires: golang >= 1.26.3 @@ -36,17 +43,12 @@ BuildRequires: go1.26 >= 1.26.3 BuildRequires: golang-packaging %endif -BuildRequires: bash-completion -BuildRequires: fish -BuildRequires: zsh -Suggests: glab-doc %description glab is a command line tool bringing GitLab's features to the command line. %package doc Summary: Documentation for GLab -Group: Documentation/HTML BuildArch: noarch %description doc @@ -54,7 +56,6 @@ %package bash-completion Summary: Bash completion for %{name} -Group: System/Shells Requires: %{name} = %{version} Supplements: (%{name} and bash) BuildArch: noarch @@ -64,7 +65,6 @@ %package fish-completion Summary: Fish completion for %{name} -Group: System/Shells Requires: %{name} = %{version} Supplements: (%{name} and fish) BuildArch: noarch @@ -74,7 +74,6 @@ %package zsh-completion Summary: Zsh completion for %{name} -Group: System/Shells Requires: %{name} = %{version} Supplements: (%{name} and zsh) BuildArch: noarch @@ -87,7 +86,7 @@ %build # hash will be shortened by COMMIT_HASH:0:8 later -COMMIT_HASH="$(sed -n 's/commit: \(.*\)/\1/p' %_sourcedir/%{name}.obsinfo)" +COMMIT_HASH="$(sed -n 's/commit: \(.*\)/\1/p' %{_sourcedir}/%{name}.obsinfo)" DATE_FMT="+%%Y-%%m-%%dT%%H:%%M:%%SZ" BUILD_DATE=$(date -u -d "@${SOURCE_DATE_EPOCH}" "${DATE_FMT}" 2>/dev/null || date -u -r "${SOURCE_DATE_EPOCH}" "${DATE_FMT}" 2>/dev/null || date -u "${DATE_FMT}") ++++++ _service ++++++ --- /var/tmp/diff_new_pack.5MpHoS/_old 2026-08-19 17:57:34.467391515 +0200 +++ /var/tmp/diff_new_pack.5MpHoS/_new 2026-08-19 17:57:34.471391659 +0200 @@ -3,7 +3,7 @@ <param name="url">https://gitlab.com/gitlab-org/cli.git</param> <param name="scm">git</param> <param name="package-meta">yes</param> - <param name="revision">refs/tags/v1.113.0</param> + <param name="revision">refs/tags/v1.114.0</param> <param name="versionformat">@PARENT_TAG@</param> <param name="versionrewrite-pattern">v(.*)</param> <param name="changesgenerate">enable</param> ++++++ _servicedata ++++++ --- /var/tmp/diff_new_pack.5MpHoS/_old 2026-08-19 17:57:34.507392950 +0200 +++ /var/tmp/diff_new_pack.5MpHoS/_new 2026-08-19 17:57:34.512393129 +0200 @@ -1,6 +1,6 @@ <servicedata> <service name="tar_scm"> <param name="url">https://gitlab.com/gitlab-org/cli.git</param> - <param name="changesrevision">d62881304ccba9e24d07bcfb2c5e8bcae3f17f75</param></service></servicedata> + <param name="changesrevision">4d7c6cda781ab2922c6f207d50cf744461c0e965</param></service></servicedata> (No newline at EOF) ++++++ glab-1.113.0.obscpio -> glab-1.114.0.obscpio ++++++ ++++ 10418 lines of diff (skipped) ++++++ glab-CVE-2026-39821-idna-punycode.patch ++++++ From: Pavel Dostál <[email protected]> Subject: idna: reject all-ASCII xn-- labels regardless of Go's unicode.Version Backported from golang.org/x/net commit f05f21be5927155a88b371674c298ada54b71cf5 ("idna: reject all-ASCII xn-- labels on all Go versions"), fixing CVE-2026-39821 (boo#1266614). The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label, e.g. ToUnicode("xn--example-.com") incorrectly returns "example.com" instead of an error. The original fix for this (golang.org/x/net commit introducing golang-review 767220) only takes effect when Go's internal unicode.Version is >= 16.0.0. As of the Go toolchain used to build this package, unicode.Version is still 15.0.0, so the check never triggers and the vendored code remains vulnerable regardless of the x/net release used. This patch removes that version gate, matching upstream's follow-up fix. --- a/vendor/golang.org/x/net/idna/idna.go +++ b/vendor/golang.org/x/net/idna/idna.go @@ -400,7 +400,11 @@ func (p *Profile) process(s string, toASCII bool) (string, error) { // Spec says keep the old label. continue } - if unicode16 && err == nil && len(u) > 0 && isASCII(u) { + if err == nil && len(u) > 0 && isASCII(u) { + // UTS 43 pre-revision 33 doesn't classify a xn-- label + // which contains only ASCII characters as an error, + // but that's a specification bug and a security issue. + // Always return an error in this case. err = punyError(enc) } isBidi = isBidi || bidirule.DirectionString(u) != bidi.LeftToRight ++++++ glab-disable_update_check.patch ++++++ --- /var/tmp/diff_new_pack.5MpHoS/_old 2026-08-19 17:57:38.513536628 +0200 +++ /var/tmp/diff_new_pack.5MpHoS/_new 2026-08-19 17:57:38.524537023 +0200 @@ -4,10 +4,15 @@ Subject: [PATCH] disable update check Signed-off-by: Johannes Kastl <[email protected]> + +pdostal: rebased for 1.114.0 - the old config.yaml.lock/config_stub.go +hunks no longer apply since upstream moved the default to a schema.go +KeyDef table; restored the actual disabling effect by flipping that +KeyDef's Default there instead. --- - commands/config/config.go | 199 +++++++++++++++++++++++++++++++ - internal/config/config.yaml.lock | 2 +- - 3 files changed, 201 insertions(+), 2 deletions(-) + commands/config/config.go | 199 +++++++++++++++++++++++++++++++++++++++++++ + internal/config/schema.go | 2 +- + 2 files changed, 200 insertions(+), 1 deletion(-) create mode 100644 commands/config/config.go diff --git a/commands/config/config.go b/commands/config/config.go @@ -215,6 +220,19 @@ + cmd.Flags().BoolVarP(&isLocal, "local", "l", false, "Open '.git/glab-cli/config.yml' file instead of the global '~/.config/glab-cli/config.yml' file.") + return cmd +} +diff --git a/internal/config/schema.go b/internal/config/schema.go +index 1111111..2222222 100644 +--- a/internal/config/schema.go ++++ b/internal/config/schema.go +@@ -86,7 +86,7 @@ var KeySchema = []KeyDef{ + }, + { + Name: "check_update", Scope: ScopeGlobal, Type: TypeBool, +- Default: "true", UserSettable: true, ++ Default: "false", UserSettable: true, + Description: "Allow glab to automatically check for updates and notify you when there are new updates.", + }, + { -- 2.51.2 ++++++ glab.obsinfo ++++++ --- /var/tmp/diff_new_pack.5MpHoS/_old 2026-08-19 17:57:38.595539569 +0200 +++ /var/tmp/diff_new_pack.5MpHoS/_new 2026-08-19 17:57:38.608540035 +0200 @@ -1,5 +1,5 @@ name: glab -version: 1.113.0 -mtime: 1786437973 -commit: d62881304ccba9e24d07bcfb2c5e8bcae3f17f75 +version: 1.114.0 +mtime: 1787024275 +commit: 4d7c6cda781ab2922c6f207d50cf744461c0e965 ++++++ vendor.tar.gz ++++++ /work/SRC/openSUSE:Factory/glab/vendor.tar.gz /work/SRC/openSUSE:Factory/.glab.new.1258/vendor.tar.gz differ: char 13, line 1
