Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package mcphost for openSUSE:Factory checked in at 2026-09-21 12:22:15 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/mcphost (Old) and /work/SRC/openSUSE:Factory/.mcphost.new.383539 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "mcphost" Mon Sep 21 12:22:15 2026 rev:14 rq:1379337 version:0.34.0 Changes: -------- --- /work/SRC/openSUSE:Factory/mcphost/mcphost.changes 2026-09-02 17:00:19.625313106 +0200 +++ /work/SRC/openSUSE:Factory/.mcphost.new.383539/mcphost.changes 2026-09-21 12:22:19.684056865 +0200 @@ -1,0 +2,15 @@ +Fri Sep 18 07:28:10 UTC 2026 - Egbert Eich <[email protected]> + +- Fix + * a potential DoS via crash due to missing ':authority' and + 'Host' headers in gRPC-Go xDS servers CVE-2026-84445 (bsc#1278853), + * a potential heap memory exhaustion via HTTP/2 DATA frame + fragmentation CVE-2026-84304 (bsc#1279396), + * a potential bypass of authorization policies via mixed-case + or canonical-case header matches due to an xDS RBAC HTTP filter + implementation issue CVE-2026-84303 (bsc#1279274) + by updating google.golang.org/grpc to v1.83.2 +- Remove replacement of golang.org/x/net to @v0.57.0 as the update + of google.golang.org/grpc already requires @v0.58.0 + +------------------------------------------------------------------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ _scmsync.obsinfo ++++++ --- /var/tmp/diff_new_pack.hLXYRX/_old 2026-09-21 12:22:22.593178449 +0200 +++ /var/tmp/diff_new_pack.hLXYRX/_new 2026-09-21 12:22:22.598178658 +0200 @@ -1,5 +1,5 @@ -mtime: 1788329544 -commit: 90f730571fb2df37f64f2b0f52985d3377a17bc070029dfa295522108bf7066a +mtime: 1789718153 +commit: f1cf65b5fa560d3ae33e079410fd73b02d37bf78fc4a018159ebab8e7c26f071 url: https://src.opensuse.org/AI/mcphost revision: main ++++++ _service ++++++ --- /var/tmp/diff_new_pack.hLXYRX/_old 2026-09-21 12:22:22.633180121 +0200 +++ /var/tmp/diff_new_pack.hLXYRX/_new 2026-09-21 12:22:22.638180330 +0200 @@ -4,9 +4,6 @@ google.golang.org/grpc=google.golang.org/[email protected] </param> <param name="replace"> - golang.org/x/net=golang.org/x/[email protected] - </param> - <param name="replace"> github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream=github.com/aws/aws-sdk-go-v2/aws/protocol/[email protected] </param> <param name="replace"> @@ -18,6 +15,12 @@ <param name="replace"> github.com/mark3labs/mcp-go=github.com/mark3labs/[email protected] </param> + <param name="replace"> + golang.org/x/crypto=golang.org/x/[email protected] + </param> + <param name="replace"> + google.golang.org/grpc=google.golang.org/[email protected] + </param> </service> </services> ++++++ build.specials.obscpio ++++++ ++++++ build.specials.obscpio ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/.gitignore new/.gitignore --- old/.gitignore 1970-01-01 01:00:00.000000000 +0100 +++ new/.gitignore 2026-09-18 09:55:53.000000000 +0200 @@ -0,0 +1,4 @@ +*.obscpio +*.osc +_build.* +.pbuild ++++++ vendor.tar.gz ++++++ /work/SRC/openSUSE:Factory/mcphost/vendor.tar.gz /work/SRC/openSUSE:Factory/.mcphost.new.383539/vendor.tar.gz differ: char 31, line 1
