Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package hauler for openSUSE:Factory checked in at 2026-09-07 15:50:22 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/hauler (Old) and /work/SRC/openSUSE:Factory/.hauler.new.1265 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "hauler" Mon Sep 7 15:50:22 2026 rev:25 rq:1376031 version:2.1.0 Changes: -------- --- /work/SRC/openSUSE:Factory/hauler/hauler.changes 2026-09-04 12:42:56.197908138 +0200 +++ /work/SRC/openSUSE:Factory/.hauler.new.1265/hauler.changes 2026-09-07 15:50:23.317448458 +0200 @@ -1,0 +2,17 @@ +Sun Sep 6 16:13:59 UTC 2026 - Dirk Müller <[email protected]> + +- update vendor.tar to fix: + * bsc#1278584, CVE-2026-56855,CVE-2026-56854,CVE-2026-78662: + hauler: golang.org/x/crypto/ssh: authentication bypass and + deadlocks in the crypto/ssh library + +------------------------------------------------------------------- +Fri Sep 4 19:29:54 UTC 2026 - Dirk Müller <[email protected]> + +- update vendor.tar to fix: + * bsc#1279416, CVE-2026-84304 + * bsc#1279296, CVE-2026-84303 + * bsc#1278934, CVE-2026-84445: google.golang.org/grpc: DoS via + crash due to missing ':authority' and 'Host' headers + +------------------------------------------------------------------- @@ -4,2 +21 @@ -- update to 2.1.0 (bsc#1265425, CVE-2026-41888, - bsc#1278584, CVE-2026-56855,CVE-2026-56854,CVE-2026-78662): +- update to 2.1.0 (bsc#1265425, CVE-2026-41888): ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ _service ++++++ --- /var/tmp/diff_new_pack.DHck9Y/_old 2026-09-07 15:50:25.568542591 +0200 +++ /var/tmp/diff_new_pack.DHck9Y/_new 2026-09-07 15:50:25.579543051 +0200 @@ -2,6 +2,8 @@ <service name="download_files" mode="manual"/> <service name="go_modules" mode="manual"> <param name="compression">zst</param> + <param name="replace">google.golang.org/grpc=google.golang.org/[email protected]</param> + <param name="replace">golang.org/x/crypto=golang.org/x/[email protected]</param> </service> </services> ++++++ vendor.tar.zst ++++++ /work/SRC/openSUSE:Factory/hauler/vendor.tar.zst /work/SRC/openSUSE:Factory/.hauler.new.1265/vendor.tar.zst differ: char 7, line 1
