Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package bugwarden for openSUSE:Factory checked in at 2026-11-02 16:39:49 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/bugwarden (Old) and /work/SRC/openSUSE:Factory/.bugwarden.new.1255 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "bugwarden" Mon Nov 2 16:39:49 2026 rev:6 rq:1394424 version:0.7.0 Changes: -------- --- /work/SRC/openSUSE:Factory/bugwarden/bugwarden.changes 2026-09-08 16:54:56.750050917 +0200 +++ /work/SRC/openSUSE:Factory/.bugwarden.new.1255/bugwarden.changes 2026-11-02 16:40:41.764060562 +0100 @@ -1,0 +2,30 @@ +Mon Nov 2 08:57:12 UTC 2026 - Martin Pluskal <[email protected]> + +- Update to 0.7.0: + * Add a changed_since filter to bugs_quicksearch + * Keep Bugzilla's error text out of read and write tool results + * Scrub Bug ID custom fields from served bugs, bug history and + write responses, and assess their targets before a write + * Refuse self-dependency and self-duplicate writes, quicksearch + predicates over hidden fields, and all-digit or path-unsafe + bug field names before any request + * Judge create_bug as Bugzilla will file it, and drop BMO's + comment_count from served bugs + * Audit stdio calls abandoned mid-dispatch and upstream errors + with Bugzilla's code; bound OTLP batches by encoded size + * By design, an initialize asking for 2026-07-28 now negotiates + 2025-11-25: that revision has no handshake and is served to + clients that skip initialize + * Many more fixes and improvements; see upstream's release notes + for the full list +- Vendored rustls 0.23.46 and rustls-webpki 0.103.16: + * CVE-2026-111943: rustls-webpki could accept distrusted eMudhra + intermediates (RUSTSEC-2026-0382, boo#1286261) + * RUSTSEC-2026-0285: rustls accepted TLS 1.3 handshake messages + across encryption levels + * RUSTSEC-2026-0349: an unauthenticated ServerHello could + downgrade later rustls connections to classical key exchange +- Vendor with cargo_vendor filter=true and strip the prebuilt + Windows objects left in ring and aws-lc-sys + +------------------------------------------------------------------- Old: ---- bugwarden-0.6.0.obscpio bugwarden-0.6.0.tar.zst bugwarden.obsinfo New: ---- bugwarden-0.7.0.tar.zst ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ bugwarden.spec ++++++ --- /var/tmp/diff_new_pack.vTIuvi/_old 2026-11-02 16:40:43.187120185 +0100 +++ /var/tmp/diff_new_pack.vTIuvi/_new 2026-11-02 16:40:43.192120394 +0100 @@ -17,7 +17,7 @@ Name: bugwarden -Version: 0.6.0 +Version: 0.7.0 Release: 0 Summary: MCP server for Bugzilla with operator-controlled security guards # Upstream is Apache-2.0; the rest is the aggregate of the crates statically @@ -25,6 +25,11 @@ License: (Apache-2.0 OR BSL-1.0) AND (Apache-2.0 OR ISC OR MIT) AND (Apache-2.0 OR MIT) AND (MIT OR Unlicense) AND Apache-2.0 AND BSD-3-Clause AND ISC AND MIT AND Unicode-3.0 URL: https://github.com/plusky/bugwarden Source0: %{name}-%{version}.tar.zst +# Vendored with cargo_vendor filter=true (crates no Linux target uses are +# emptied), then repacked with ring's pregenerated/*-nasm.o and *-win32n.o +# and aws-lc-sys's builder/prebuilt-nasm/*.obj stripped and their +# .cargo-checksum.json entries dropped: prebuilt objects only Windows +# targets use. Redo the strip after every re-vendor. Source1: vendor.tar.zst # The HTTP transport tests in %%check construct a reqwest client, which # refuses to build when the system CA store is empty — even though the @@ -87,7 +92,7 @@ rm -f rust-toolchain.toml %build -%{cargo_build} +%cargo_build %install install -D -m 0755 target/release/%{name} %{buildroot}%{_bindir}/%{name} @@ -114,7 +119,7 @@ %{buildroot}%{_datadir}/fish/vendor_completions.d/%{name}.fish %check -%{cargo_test} +%cargo_test %files %license LICENSE ++++++ _service ++++++ --- /var/tmp/diff_new_pack.vTIuvi/_old 2026-11-02 16:40:43.252122908 +0100 +++ /var/tmp/diff_new_pack.vTIuvi/_new 2026-11-02 16:40:43.257123118 +0100 @@ -2,7 +2,7 @@ <service name="obs_scm" mode="manual"> <param name="url">https://github.com/plusky/bugwarden.git</param> <param name="scm">git</param> - <param name="revision">0.6.0</param> + <param name="revision">0.7.0</param> <param name="versionformat">@PARENT_TAG@</param> <param name="exclude">.git</param> </service> @@ -12,17 +12,17 @@ <param name="compression">zst</param> </service> <service name="set_version" mode="manual"/> - <!-- Vendor upstream's own Cargo.lock. Updating past that lock pulls - rmcp 3.2.0, which the "3.1" requirement accepts but which no longer - negotiates the 2026-07-28 protocol revision this release serves: - three %check tests then fail on the fallback to 2025-11-25. - source_validator's "missing update=true" note is expected here; - cargo_audit still runs, and it is clean for this lock. Re-test - update=true on the next release rather than carrying this blind. --> + <!-- update=false keeps upstream's Cargo.lock as it is: the crate + set upstream's CI tests and checks with cargo deny, which cargo_audit + re-checks here. source_validator's "missing update=true" note is + expected. filter=true empties the crates no Linux target uses; the + Windows objects it keeps in ring and aws-lc-sys are stripped + afterwards, see the spec comment above Source1. --> <service name="cargo_vendor" mode="manual"> <param name="srcdir">bugwarden</param> <param name="compression">zst</param> <param name="update">false</param> + <param name="filter">true</param> </service> <service name="cargo_audit" mode="manual"> <param name="srcdir">bugwarden</param> ++++++ bugwarden-0.6.0.tar.zst -> bugwarden-0.7.0.tar.zst ++++++ ++++ 22780 lines of diff (skipped) ++++++ vendor.tar.zst ++++++ /work/SRC/openSUSE:Factory/bugwarden/vendor.tar.zst /work/SRC/openSUSE:Factory/.bugwarden.new.1255/vendor.tar.zst differ: char 5, line 1
