Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package trivy for openSUSE:Factory checked in at 2026-09-07 11:34:12 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/trivy (Old) and /work/SRC/openSUSE:Factory/.trivy.new.1265 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "trivy" Mon Sep 7 11:34:12 2026 rev:103 rq:1376017 version:0.74.0 Changes: -------- --- /work/SRC/openSUSE:Factory/trivy/trivy.changes 2026-09-04 12:42:54.733856722 +0200 +++ /work/SRC/openSUSE:Factory/.trivy.new.1265/trivy.changes 2026-09-07 11:35:00.910945920 +0200 @@ -1,0 +2,12 @@ +Sun Sep 6 13:29:38 UTC 2026 - Dirk Müller <[email protected]> + +- update vendor to address: + * bsc#1279395, CVE-2026-84304: trivy: github.com/grpc/grpc-go: + heap memory exhaustion via HTTP/2 DATA frame + * bsc#1279392, CVE-2026-84445: trivy: google.golang.org/grpc: DoS + via crash due to missing `:authority` and `Host` headers + * bsc#1279390, CVE-2026-84303: trivy: github.com/grpc/grpc-go: + xDS RBAC HTTP filter implementation issue allows for bypass + of authorization + +------------------------------------------------------------------- @@ -4 +16 @@ -- Update to version 0.74.0 (bsc#1276326, CVE-2026-50163, +- Update to version 0.74.0 (bsc#1278702, CVE-2026-50163, ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ _scmsync.obsinfo ++++++ --- /var/tmp/diff_new_pack.7YqMvJ/_old 2026-09-07 11:35:04.166059905 +0200 +++ /var/tmp/diff_new_pack.7YqMvJ/_new 2026-09-07 11:35:04.169060010 +0200 @@ -1,5 +1,5 @@ -mtime: 1788468451 -commit: 059f131595d94721935e9bb462c6ee4b25f2a8ba0701bef42b657b240d860824 +mtime: 1788702191 +commit: 338e63f944e88480d3852ae5cc141c0a8787f6a7af09c24c0d64b0a758b86472 url: https://src.opensuse.org/dirkmueller/trivy.git revision: factory ++++++ _service ++++++ --- /var/tmp/diff_new_pack.7YqMvJ/_old 2026-09-07 11:35:04.193060851 +0200 +++ /var/tmp/diff_new_pack.7YqMvJ/_new 2026-09-07 11:35:04.197060991 +0200 @@ -16,6 +16,7 @@ </service> <service name="go_modules" mode="manual"> <param name="compression">zst</param> + <param name="replace">google.golang.org/grpc=google.golang.org/[email protected]</param> </service> </services> ++++++ build.specials.obscpio ++++++ ++++++ build.specials.obscpio ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/.gitignore new/.gitignore --- old/.gitignore 1970-01-01 01:00:00.000000000 +0100 +++ new/.gitignore 2026-09-06 15:43:11.000000000 +0200 @@ -0,0 +1 @@ +.osc ++++++ vendor.tar.zst ++++++ /work/SRC/openSUSE:Factory/trivy/vendor.tar.zst /work/SRC/openSUSE:Factory/.trivy.new.1265/vendor.tar.zst differ: char 7, line 1
