Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package znc for openSUSE:Factory checked in at 2026-09-14 16:22:45 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/znc (Old) and /work/SRC/openSUSE:Factory/.znc.new.1265 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "znc" Mon Sep 14 16:22:45 2026 rev:36 rq:1377762 version:1.10.3 Changes: -------- --- /work/SRC/openSUSE:Factory/znc/znc.changes 2026-06-03 20:30:41.057763504 +0200 +++ /work/SRC/openSUSE:Factory/.znc.new.1265/znc.changes 2026-09-14 16:22:49.012662639 +0200 @@ -1,0 +2,12 @@ +Sun Sep 13 16:57:50 UTC 2026 - Martin Pluskal <[email protected]> + +- Update to version 1.10.3 (security release): + * CVE-2026-82373: use-after-free when unloading modules, + triggered by unprivileged users + * CVE-2026-82374: null pointer dereference in crypt module, + triggered by IRC server + * Update bundled jQuery to 3.5.1 (CVE-2020-11022, CVE-2020-11023) +- Fetch the tarball from https://files.asokolov.org/ (linked from + the upstream homepage) until znc.in/releases/ carries 1.10.3 + +------------------------------------------------------------------- Old: ---- znc-1.10.2.tar.gz znc-1.10.2.tar.gz.sig New: ---- znc-1.10.3.tar.gz znc-1.10.3.tar.gz.sig ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ znc.spec ++++++ --- /var/tmp/diff_new_pack.mSL0pE/_old 2026-09-14 16:22:50.022705042 +0200 +++ /var/tmp/diff_new_pack.mSL0pE/_new 2026-09-14 16:22:50.025705168 +0200 @@ -17,13 +17,16 @@ Name: znc -Version: 1.10.2 +Version: 1.10.3 Release: 0 Summary: Advanced IRC Bouncer License: Apache-2.0 URL: https://znc.in -Source0: %{url}/releases/%{name}-%{version}.tar.gz -Source1: %{url}/releases/%{name}-%{version}.tar.gz.sig +# Since 1.10.3 upstream links the release tarball from the homepage to +# files.asokolov.org instead of znc.in/releases/ (verified via the .sig +# against znc.keyring); keep this URL until znc.in/releases/ carries it again. +Source0: https://files.asokolov.org/%{name}-%{version}.tar.gz +Source1: https://files.asokolov.org/%{name}-%{version}.tar.gz.sig Source2: https://keyserver.ubuntu.com/pks/lookup?op=get&search=0xd5823cacb477191cac0075555ae420cc0209989e#/%{name}.keyring Source3: %{name}.service Patch0: no-timestamp.patch @@ -34,6 +37,8 @@ BuildRequires: gettext BuildRequires: libboost_locale-devel >= 1.70 BuildRequires: ninja +# Keep plain perl deps: spec-cleaner --perl explodes them into hundreds of +# perl(...) lines on this non-Perl package (accepted deviation). BuildRequires: perl BuildRequires: pkgconfig BuildRequires: swig >= 4.0.1 @@ -46,9 +51,9 @@ BuildRequires: pkgconfig(systemd) BuildRequires: pkgconfig(tcl) BuildRequires: pkgconfig(zlib) +Requires(pre): shadow Provides: group(%{name}) Provides: user(%{name}) -Requires(pre): shadow %systemd_ordering %description ++++++ znc-1.10.2.tar.gz -> znc-1.10.3.tar.gz ++++++ ++++ 22041 lines of diff (skipped)
