Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package gh for openSUSE:Factory checked in at 2026-10-17 21:24:34 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/gh (Old) and /work/SRC/openSUSE:Factory/.gh.new.3698736 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "gh" Sat Oct 17 21:24:34 2026 rev:104 rq:1385228 version:2.102.0 Changes: -------- --- /work/SRC/openSUSE:Factory/gh/gh.changes 2026-09-07 11:33:09.060033513 +0200 +++ /work/SRC/openSUSE:Factory/.gh.new.3698736/gh.changes 2026-10-17 21:24:35.889867249 +0200 @@ -1,0 +2,39 @@ +Fri Oct 16 15:10:22 UTC 2026 - Pavel Dostál <[email protected]> + +- Update to version 2.102.0, fixing four security issues + (GHSA-39wj-f2f4-978v, GHSA-4mq3-hpgx-9cx8, GHSA-qcwj-mr2r-2cx7, + GHSA-wjmr-j3rp-mh2g): + * gh release/run/attestation download and repo read-file --output + could write to an unintended file through symbolic links + * gh attestation verify compared --source-ref case-insensitively + * gh attestation verify matched --signer-workflow only by prefix + * gh skill search could inject options into gh skill install + * Copy auth codes to the clipboard by default (gh config set + clipboard disabled to opt out) + * Remove the gh repo garden command and the multi-account migration + * Use API SSH URLs for repository clones + * Validate repository names during interactive creation + * Fix remote branch deletion on owner case mismatch + * Propagate the gh path to extensions + * Allow ghu_ tokens to attach files + * Allow gh repo set-default --unset without an argument + * Bump go-gh to 2.16.1, golang.org/x/crypto to 0.57.0, + github.com/klauspost/compress to 1.20.1 and Go to 1.27.1 +- Add gh-bump-x-net.patch: update golang.org/x/net to 0.60.0 to fix + excessive CPU consumption on repeated HTTP/2 initial window + changes (CVE-2026-78669, bsc#1285291). +- Require golang(API) >= 1.27 as upstream moved to Go 1.27. +- Not affected, vendored dependencies are above the fixed version: + * CVE-2026-84445 (bsc#1278962): grpc is 1.83.2, fixed in 1.83.2 + * CVE-2026-84304 (bsc#1279208), CVE-2026-84303 (bsc#1279310): + grpc is 1.83.2, fixed in 1.83.1 + * CVE-2026-41178 (bsc#1276707): otel/baggage is 1.44.0, fixed in + 1.44.0 + * CVE-2026-63209 (bsc#1283727): klauspost/compress is 1.20.1, + contains the fix of 1.18.7 + * CVE-2026-72924 (bsc#1276755): gh is above 2.98.0, the fixed + version + * CVE-2026-59831 (bsc#1271215): gh is above 2.95.0, the last + affected version + +------------------------------------------------------------------- Old: ---- cli-2.100.0.tar.zst New: ---- cli-2.102.0.tar.zst gh-bump-x-net.patch ----------(New B)---------- New: github.com/klauspost/compress to 1.20.1 and Go to 1.27.1 - Add gh-bump-x-net.patch: update golang.org/x/net to 0.60.0 to fix excessive CPU consumption on repeated HTTP/2 initial window ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ gh.spec ++++++ --- /var/tmp/diff_new_pack.E2Rqlq/_old 2026-10-17 21:24:37.206922192 +0200 +++ /var/tmp/diff_new_pack.E2Rqlq/_new 2026-10-17 21:24:37.208922276 +0200 @@ -20,17 +20,19 @@ %define goflags "-buildmode=pie -trimpath -mod=vendor -modcacherw" %define sname cli Name: gh -Version: 2.100.0 +Version: 2.102.0 Release: 0 Summary: The official CLI for GitHub License: MIT URL: https://cli.github.com/ Source0: %{sname}-%{version}.tar.zst Source1: vendor.tar.gz +# PATCH-FIX-OPENSUSE gh-bump-x-net.patch bsc#1285291 -- golang.org/x/net 0.60.0 (CVE-2026-78669); drop once upstream ships it +Patch0: gh-bump-x-net.patch BuildRequires: fish # spec-cleaner --perl would explode this into perl(Git::SVN::*) modules; git-core is a tool dep here, not a perl one BuildRequires: git-core -BuildRequires: golang(API) >= 1.26 +BuildRequires: golang(API) >= 1.27 # This is needed for some tests BuildRequires: openssh-clients BuildRequires: openssh-common ++++++ _service ++++++ --- /var/tmp/diff_new_pack.E2Rqlq/_old 2026-10-17 21:24:37.241923653 +0200 +++ /var/tmp/diff_new_pack.E2Rqlq/_new 2026-10-17 21:24:37.244923778 +0200 @@ -3,7 +3,7 @@ <param name="url">https://github.com/cli/cli</param> <param name="scm">git</param> <param name="exclude">.git</param> - <param name="revision">v2.100.0</param> + <param name="revision">v2.102.0</param> <param name="versionformat">@PARENT_TAG@</param> <param name="changesgenerate">enable</param> <param name="versionrewrite-pattern">v(.*)</param> @@ -16,7 +16,7 @@ <param name="compression">zst</param> </service> <service name="go_modules" mode="manual"> - <param name="archive">cli-2.100.0.tar.zst</param> + <param name="archive">cli-2.102.0.tar.zst</param> </service> </services> ++++++ _servicedata ++++++ --- /var/tmp/diff_new_pack.E2Rqlq/_old 2026-10-17 21:24:37.266924695 +0200 +++ /var/tmp/diff_new_pack.E2Rqlq/_new 2026-10-17 21:24:37.269924821 +0200 @@ -1,7 +1,7 @@ <servicedata> <service name="tar_scm"> <param name="url">https://github.com/cli/cli</param> - <param name="changesrevision">45437bc7eeeb3359bbfddd1742f79de7652fd3e2</param> + <param name="changesrevision">fc4b137cdef0a6bd28fd461b7cf9c84a5812a8cd</param> </service> </servicedata> (No newline at EOF) ++++++ cli-2.100.0.tar.zst -> cli-2.102.0.tar.zst ++++++ /work/SRC/openSUSE:Factory/gh/cli-2.100.0.tar.zst /work/SRC/openSUSE:Factory/.gh.new.3698736/cli-2.102.0.tar.zst differ: char 7, line 1 ++++++ gh-bump-x-net.patch ++++++ --- a/go.mod +++ b/go.mod @@ -181,7 +181,7 @@ go.opentelemetry.io/otel/trace v1.44.0 // indirect go.yaml.in/yaml/v3 v3.0.5 // indirect golang.org/x/mod v0.41.0 // indirect - golang.org/x/net v0.58.0 // indirect + golang.org/x/net v0.60.0 // indirect golang.org/x/tools v0.49.0 // indirect google.golang.org/genproto/googleapis/api v0.0.0-20260526163538-3dc84a4a5aaa // indirect google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa // indirect --- a/go.sum +++ b/go.sum @@ -575,6 +575,8 @@ golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs= golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To= golang.org/x/net v0.58.0/go.mod h1:YwCddHnFlT7eLQqVprV19OnhLGtc5xOKgE0RyqgfWAU= +golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU= +golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg= golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs= golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q= golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= ++++++ vendor.tar.gz ++++++ /work/SRC/openSUSE:Factory/gh/vendor.tar.gz /work/SRC/openSUSE:Factory/.gh.new.3698736/vendor.tar.gz differ: char 75, line 1
