Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package coredns for openSUSE:Factory checked in at 2026-10-16 20:09:25 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/coredns (Old) and /work/SRC/openSUSE:Factory/.coredns.new.3698736 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "coredns" Fri Oct 16 20:09:25 2026 rev:37 rq:1385102 version:1.14.7 Changes: -------- --- /work/SRC/openSUSE:Factory/coredns/coredns.changes 2026-08-29 17:43:57.512433490 +0200 +++ /work/SRC/openSUSE:Factory/.coredns.new.3698736/coredns.changes 2026-10-16 20:12:57.204401269 +0200 @@ -1,0 +2,8 @@ +Fri Oct 16 05:37:57 UTC 2026 - Andrea Manzini <[email protected]> + +- Bump vendored google.golang.org/grpc from 1.83.0 to 1.83.1: + * CVE-2026-84304: heap memory exhaustion via HTTP/2 DATA frame + fragmentation in the gRPC transport (boo#1279216) + * Done through the go_modules "require" parameter in _service + +------------------------------------------------------------------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ _service ++++++ --- /var/tmp/diff_new_pack.PwK0Jv/_old 2026-10-16 20:12:58.826469501 +0200 +++ /var/tmp/diff_new_pack.PwK0Jv/_new 2026-10-16 20:12:58.829469627 +0200 @@ -11,6 +11,8 @@ <service mode="disabled" name="set_version"> </service> <service name="go_modules" mode="manual"> + <!-- CVE-2026-84304: pins grpc, not a floor - drop once upstream go.mod has >= 1.83.1 --> + <param name="require">google.golang.org/[email protected]</param> </service> </services> ++++++ vendor.tar.gz ++++++ /work/SRC/openSUSE:Factory/coredns/vendor.tar.gz /work/SRC/openSUSE:Factory/.coredns.new.3698736/vendor.tar.gz differ: char 16, line 1
