Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package newsboat for openSUSE:Factory checked in at 2026-10-09 21:43:06 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/newsboat (Old) and /work/SRC/openSUSE:Factory/.newsboat.new.3698736 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "newsboat" Fri Oct 9 21:43:06 2026 rev:4 rq:1383306 version:2.45 Changes: -------- --- /work/SRC/openSUSE:Factory/newsboat/newsboat.changes 2026-09-18 22:15:57.371273849 +0200 +++ /work/SRC/openSUSE:Factory/.newsboat.new.3698736/newsboat.changes 2026-10-09 21:43:11.948812352 +0200 @@ -1,0 +2,48 @@ +Tue Oct 6 12:19:23 UTC 2026 - Michael Vetter <[email protected]> + +- Update to 2.45: + Added: + * pb-reload command which (like pb-purge) loads new items from the queue but + (unlike pb-purge) does not purge anything + * keep-forever-if-flagged-with setting to mark items that should not be + deleted by keep-articles-days (#2722) + * listnormal_deleted and listfocus_deleted highlight groups for deleted (but + not yet purged) items. Defaults are the same as listnormal and + listfocus, so existing colorschemes don't need updating + Changed: + * Updated translations: Dutch, German, Italian, Russian and Ukrainian, Spanish, Turkish + * Bumped minimum supported Rust version to 1.94.0 + Removed: + * Ability to import OPML that contains pipe URLs, filtercmd, or URLs with + schemas other thatn http://, https://, or file://. The reason are the + security fixes listed below. If your workflows relied on these abilities, + please open and issue and let's find a way to bring these features back + without compromising other setups. + Fixed: + * exec: feeds garbled the encoding (#1412) + Security: + * Remote code execution via manual OPML import (--import-from-opml) + Newsboat imported pipe-URLs (turning them into exec: feeds) and + filtercmd URLs (turning them into filter: feeds). As a result, Newsboat + executed shell commands provided in the OPML file. + Starting with 2.45, Newsboat will warn about each of those during import and + either skip the URL (if it's a pipe-URL) or ignore the filtering part (if + it's a filtercmd URL). You can add them manually if you trust the OPML + source. + Disclosed via a pull request #3426. Fixed in #3445. + * GHSA-pvg7-gjxf-23c9: Podboat could write at arbitrary paths + Newsboat writes podcast URLs and filenames into a "queue" file, which is in + plain text and uses tabs and spaces for structuring the data. The queue file + is then read by Podboat, which downloads the files. Newsboat did not + sanitize podcast URLs and filenames, and Podboat did not properly validate + the file structure, giving an attacker an opportunity to mess up the file + format and trick Podboat into downloading other URLs and writing them at + arbitrary paths. + Starting with 2.45, Newsboat takes care to sanitize special characters when + writing the queue file. Additionally, Podboat ignores malformed entries in + the queue. + Users are advised to check their existing queue files for any entries they + don't recognize. + Disclosed via a pull request and fixed in #3427. + +------------------------------------------------------------------- Old: ---- newsboat-2.44.tar.xz newsboat-2.44.tar.xz.asc New: ---- newsboat-2.45.tar.xz newsboat-2.45.tar.xz.asc ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ newsboat.spec ++++++ --- /var/tmp/diff_new_pack.kpg2xT/_old 2026-10-09 21:43:14.545921195 +0200 +++ /var/tmp/diff_new_pack.kpg2xT/_new 2026-10-09 21:43:14.548921321 +0200 @@ -17,7 +17,7 @@ Name: newsboat -Version: 2.44 +Version: 2.45 Release: 0 Summary: RSS/Atom Feed Reader for Text Terminals License: MIT ++++++ newsbeuter-makefile.patch ++++++ --- /var/tmp/diff_new_pack.kpg2xT/_old 2026-10-09 21:43:14.635924967 +0200 +++ /var/tmp/diff_new_pack.kpg2xT/_new 2026-10-09 21:43:14.640925177 +0200 @@ -1,9 +1,9 @@ -Index: newsboat-2.29/Makefile +Index: newsboat-2.45/Makefile =================================================================== ---- newsboat-2.29.orig/Makefile -+++ newsboat-2.29/Makefile -@@ -25,7 +25,7 @@ DEFINES=-DLOCALEDIR='"$(localedir)"' - WARNFLAGS=-Werror -Wall -Wextra -Wunreachable-code +--- newsboat-2.45.orig/Makefile ++++ newsboat-2.45/Makefile +@@ -27,7 +27,7 @@ DEFINES=-DLOCALEDIR='"$(localedir)"' -DC + WARNFLAGS=-Werror -Wall -Wextra -Wunreachable-code -Wno-unused-function INCLUDES=-Iinclude -Istfl -Ifilter -I. -Irss -I$(CARGO_TARGET_DIR)/cxxbridge/ # Keep in sync with c++ version specified in FFI build.rs -BARE_CXXFLAGS=-std=c++17 -O2 -ggdb $(INCLUDES) ++++++ newsboat-2.44.tar.xz -> newsboat-2.45.tar.xz ++++++ ++++ 33019 lines of diff (skipped) ++++++ newsboat.keyring ++++++ --- /var/tmp/diff_new_pack.kpg2xT/_old 2026-10-09 21:43:15.153946678 +0200 +++ /var/tmp/diff_new_pack.kpg2xT/_new 2026-10-09 21:43:15.159946929 +0200 @@ -13,18 +13,18 @@ uUjgptWs5hcET4UTJPL0fkwm3dP5AxfT5ouw4vtVaKl9/WFNhGvmjFEbtwARAQAB tCxOZXdzYm9hdCBwcm9qZWN0IDxuZXdzYm9hdEBnb29nbGVncm91cHMuY29tPokC VAQTAQgAPgIbAwULCQgHAwUVCgkICwUWAgMBAAIeAQIXgBYhBLixdWoN2/B2DOZ8 -z07WzWGTK56+BQJoz/wrBQkRA9LwAAoJEE7WzWGTK56+lBUP/2vqb0fNot5rw5Gw -jKcYsx/gWl92mkznGKbmsQCd7aIl1gCzcTmFo49Tj0q2XYziD2YLE7xYZSquMPRo -zCtWYU4h2RQezCoT4exWs12ijpi6Zu9kz8Ihlu7SVkN4KoQ+5kDxbbIr0S1izroQ -rmPTg1L9FF76TfF5ROHGcacDvmVMIco1govOcgpo5mE73747Wr+5uieTyjYdUyN4 -4NW9IFhS2V6ZPVUXMm9inZ2IGs97lwn/vdp52/6PYHWR2FC21BflP0O5nyU7NSUp -vNtF0DagHmCKMV2JVOU3MJkDmMMVCoXIGPDnXEKB/yEEd4LgeoOiWiTNIzjOcSVP -GGySyP46wN2ivRQM1YfbvOdH4JP/Fgxzteoy8Fwv6sVTS+P6SwIaaEEs7FlD0vQM -+dd/UdSoDfOvtkHd17TTAQFDqO2bcpQZBKqCWh5flV0j6gY0s0pwh1kdXw/FHgPt -egF9aAw+AqMSPcDrwmIUs4JhJ9zqZkXGANqXhMcpUgv4nGsQtHUnIgGDt92vDD/I -FEVErpzUulPLEUHNy5whUZaGWH9los5WvKgRc9ohns97jhtmAbUkYlu25sYKc8DS -Ge8k/MWX7W9rJSI6mlaofg1fR4u+pWEahqtfx0lZCLJxpxGOuppSc+FwiKe9PPxN -ZQle9ghDksToOc9ukOuyRdYnJxUmiQIzBBMBCAAdFiEEzmxDB5NIWOP9lKAPNWlh +z07WzWGTK56+BQJqwkEwBQkS9hf1AAoJEE7WzWGTK56+f2MP/ia0sCFruKaVEAES +J5mpnoRuj1h9PGb/tJFFN2757uENas6HRcMxHC+HEL9dU0oEnVc3NJg6fAVEv7C+ +nJ7c1QcNnb3ad1v/RaFU2YcqOn3ewzjxme5oMp0LayAx2JmoI440ia6TbRh2T5aD +cgHzJmJ6ug3Yp9iGz72N34Kk75rRpS1lrU1p+28H7AnF3gv75d7S8FcC8TAou9X2 +49ufui7t/7enoaP1m9IB9mzVGdO6weB+SENhguSibIsNPHa9fnwdS2De2O5rTGzm +wymqmqkPZFfo7H8m9PxfIkeY8MYvK/NOudGXncZddu4RRt+HknpO62NenrcTrPon +VySkSyL3fWVbrwgn1cpitB+FeojSvWTu0IKW5NJkZfTex64W4SAroR/rlXU3OQKl +W/0cWltoxUgPoqLmWZO8CZ5dHakgWZYfq/NRyHMKlVTn/uYXnzyrXlBP4wPNuQvz +MrBvJ4CPoD06zeyOvnKmDLxTjEsmffxKIofln+3JGaEis3CeJaX8cT93RMJpOwRR +rVEAud1KSHLchZpFTbVGwQr+9J1umVr3A7X8K80Boz+4wGbY9zsZ2grTh1jEMYs5 +GSejbwyiz/PB2GSuKoJGmSVPz/zPOFBLncp9z2TNI43Xg1hkvYbngtRDPmjg+XVz +AACwmeLWqLD9ER1CQTTl2WKbzdXbiQIzBBMBCAAdFiEEzmxDB5NIWOP9lKAPNWlh ogyL/QMFAlm+hzwACgkQNWlhogyL/QNIdhAAmSVR3NAvOcdVMXJrF6fElG0QG/lm uWdMmrHpZPNtH7N/9w5AIHhQ/V7ms+NrBD9+mnb/DAGNekXt7DTHMsYbtc/6sui4 0u8DAGXi9e0X58wStiGDFSptxOjAYzlawIQK3+QVlFayMbGQBq2czo8SU/waQ3FM @@ -97,19 +97,19 @@ WZqa7fmf7EO/qH2ZIL/mt/nI8RGYeZ+1ACCGzmS9qiBe2jGnQp1xmzXZEpsvZKHv y4nGawncca3A/ay19yGNRrb2jiZiCUJzsv8OMKJrBOUGnKabuWIhLEdlPP9G3PlY XnZX9TZCl1jDTweeedoedskcWx8ZCsyhhT6XUklBWQuIdzYSRS3mkxALJcfjjKLK -xa0AEQEAAYkCPAQYAQgAJgIbDBYhBLixdWoN2/B2DOZ8z07WzWGTK56+BQJoz/w0 -BQkRA9L5AAoJEE7WzWGTK56+/RIQAJe7QFLTOeONIWVvSu7ZPczekHTe02eeOFnB -IgOvEFHaIMotm9OJ0cmeVtlAt1QKjcHtQKXCrsNmYPrU5bLFrk5y0unCOQOgRWy2 -VAlP2XCYSNr48nhDtBkNWN8yRieEgtQM39aXNSfUm1OVGxzxPYq5UwLT7zCxOu48 -1bx8k9Lzr52KrGWn6Fr9cXgSb11d07R2+31zc5VrAB5nJQ9IfKsmCcW+LxDa6UDr -n/ibR2ekkF853aKVjx8bf/Ym5rOilSBjtitlMg2H1VyEtkcEax1IiFFjZZdbwh1f -hIFGl2F+NFo1kJv5V2T7cZ/hpTJklVDywoeVHANx+QOxnPZWM3NZBVO3pdN2wnEX -IEVl3lnzpR7B5nsm+aXMwA7OUKeTmHO4fCd2LjLwCdT5Xxp3UuqU3f+T6WnQMra8 -okWz0OQLS89MtvlUJgyLxmze5VJDvIzs3uTGAwtt+Mq/fTf2SdizTG58PvqF/esn -6WLIfqihPbMSa0NKe9IXYd1CFkrUpIzI8TVjMFbBkeHQzitjQ2CPq7e37PW1KmVf -oc0+VXouFTEAadV4UTJEG9FOU9RY8kSKrMSEOVu/tBxI4TMOUjeDLGByJR18ygax -AM4/qVHh5ePZq64W1VE431bTVB4JF9lsDTsiZ/Tqr8qmxpMfiX9OYpb1vbq3c9/+ -UKwu9hu7 -=o8jY +xa0AEQEAAYkCPAQYAQgAJgIbDBYhBLixdWoN2/B2DOZ8z07WzWGTK56+BQJqwkFC +BQkS9hgHAAoJEE7WzWGTK56+X9cP/iU395l5JyYb4pDjVZLnTlMHixLEBhyy/Xsc +HfJrAzo6R9E0wDHWKUVv5FGCgI/gBmyMsGULwaxlE365cQwEBegc6RpXylWDDCcz +zIYP4PkjsmSz2yjxRlaxx0p/GpmFbdcki4CHpBI/9nzZknMsz6rzD1vcFCMcUOUQ +uSR+z2rqO7e2kLp0vdBQuU6PMtc/XnGN/XzVOTxXi4oND2MbmTDTlsuYsAEtrVSJ +/EDhP5/s7aSN9wU5c6xsm5rA/lhzZq9Z+Wdqd7no29kziDskYO3bLt17WRQGFb9T +RAUv/NP3GmcMMhD0GKpBF85/WeMcJ0UK0CxPRqIpcoR2yWFp1ZTiaH+AZK4vmToT +2X5iyGapuAAVXTJH54V0syPxSsxZv1D7E8B50nrC4JDbOWAEHTB3zlYXuAATRkB/ +m9gLXOW9F/cs5id39FccoC3hV77KoYmOTMOg7GcjXsbjFWGzAo4JLJR7J+lcvG4/ +3iVjxAcTTBb8F0Dq6I3mpAnOtYczMueCSWDuNc27h9jynjEpoBseAYf33d+vtNJk +e/drDfRHq0ytXB4Gc9VjVrjx3B6Ci6vV67p+I3IkS3YKqWdpMJzDUHwSPna+j08s +/tPeBhFADHVgp5FMJqWFGHIu8Y0odsiggCzUj/Laiy0X5gmqSBXvkI1xVAWhXUIW +96XTANOh +=vrhe -----END PGP PUBLIC KEY BLOCK----- ++++++ vendor.tar.xz ++++++ /work/SRC/openSUSE:Factory/newsboat/vendor.tar.xz /work/SRC/openSUSE:Factory/.newsboat.new.3698736/vendor.tar.xz differ: char 15, line 1
