Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package grant for openSUSE:Factory checked in at 2026-11-10 14:42:16 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/grant (Old) and /work/SRC/openSUSE:Factory/.grant.new.3759290 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "grant" Tue Nov 10 14:42:16 2026 rev:27 rq:1396450 version:0.7.1 Changes: -------- --- /work/SRC/openSUSE:Factory/grant/grant.changes 2026-11-05 18:23:18.147168348 +0100 +++ /work/SRC/openSUSE:Factory/.grant.new.3759290/grant.changes 2026-11-10 14:44:44.660434090 +0100 @@ -1,0 +2,23 @@ +Tue Nov 10 06:09:22 UTC 2026 - Johannes Kastl <[email protected]> + +- Update to version 0.7.1: + * Dependencies + 9 dependency changes (9 updated). 3 vulnerabilities remediated. + - Remediated (3) + - GO-2026-6860 (High) — golang.org/x/net + - GO-2026-6866 (Medium) — golang.org/x/net + - GO-2026-6888 (Critical) — github.com/andybalholm/brotli + - Updated (9 packages) + - github.com/anchore/stereoscope v0.4.0 → v0.4.1 + - github.com/anchore/syft v1.56.0 → v1.57.1 + - github.com/andybalholm/brotli v1.2.0 → v1.2.8 + (remediated GO-2026-6888) + - github.com/bmatcuk/doublestar/v4 v4.10.3 → v4.10.4 + - github.com/gkampitakis/go-snaps v0.5.24 → v0.5.25 + - github.com/gpustack/gguf-parser-go v0.27.0 → v0.28.1 + - github.com/moby/sys/mountinfo v0.7.2 → v0.7.3 + - go.yaml.in/yaml/v3 v3.0.5 → v3.0.6 + - golang.org/x/net v0.61.0 → v0.62.0 + (remediated GO-2026-6860, GO-2026-6866) + +------------------------------------------------------------------- Old: ---- grant-0.7.0.obscpio New: ---- grant-0.7.1.obscpio ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ grant.spec ++++++ --- /var/tmp/diff_new_pack.KAp3g6/_old 2026-11-10 14:44:47.044533968 +0100 +++ /var/tmp/diff_new_pack.KAp3g6/_new 2026-11-10 14:44:47.046534052 +0100 @@ -17,7 +17,7 @@ Name: grant -Version: 0.7.0 +Version: 0.7.1 Release: 0 Summary: Search an SBOM for licenses and the packages they belong to License: Apache-2.0 ++++++ _service ++++++ --- /var/tmp/diff_new_pack.KAp3g6/_old 2026-11-10 14:44:47.085535686 +0100 +++ /var/tmp/diff_new_pack.KAp3g6/_new 2026-11-10 14:44:47.088535811 +0100 @@ -3,7 +3,7 @@ <param name="url">https://github.com/anchore/grant.git</param> <param name="scm">git</param> <param name="exclude">.git</param> - <param name="revision">refs/tags/v0.7.0</param> + <param name="revision">refs/tags/v0.7.1</param> <param name="versionformat">@PARENT_TAG@</param> <param name="versionrewrite-pattern">v(.*)</param> <param name="changesgenerate">enable</param> ++++++ _servicedata ++++++ --- /var/tmp/diff_new_pack.KAp3g6/_old 2026-11-10 14:44:47.112536817 +0100 +++ /var/tmp/diff_new_pack.KAp3g6/_new 2026-11-10 14:44:47.116536984 +0100 @@ -3,6 +3,6 @@ <param name="url">https://github.com/anchore/grant</param> <param name="changesrevision">2d9a6408e4dc1fba0a41101dd9bfb5c8e2200d74</param></service><service name="tar_scm"> <param name="url">https://github.com/anchore/grant.git</param> - <param name="changesrevision">e37c45ee0bccc0daef8d82b5a1d28cce7fb20a9f</param></service></servicedata> + <param name="changesrevision">c87af8bb5165d4e9fe38b31c48d7eae4b4d68333</param></service></servicedata> (No newline at EOF) ++++++ grant-0.7.0.obscpio -> grant-0.7.1.obscpio ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/grant-0.7.0/go.mod new/grant-0.7.1/go.mod --- old/grant-0.7.0/go.mod 2026-11-02 18:04:20.000000000 +0100 +++ new/grant-0.7.1/go.mod 2026-11-09 15:49:30.000000000 +0100 @@ -7,8 +7,8 @@ github.com/anchore/go-collections v0.1.1 github.com/anchore/go-logger v0.2.0 github.com/anchore/packageurl-go v0.2.0 - github.com/anchore/stereoscope v0.4.0 - github.com/anchore/syft v1.56.0 + github.com/anchore/stereoscope v0.4.1 + github.com/anchore/syft v1.57.1 github.com/cyphar/filepath-securejoin v0.7.0 github.com/github/go-spdx/v2 v2.8.0 github.com/google/licenseclassifier/v2 v2.0.0 @@ -63,7 +63,7 @@ github.com/anchore/go-struct-converter v0.2.0-rc2 // indirect github.com/anchore/go-sync v0.1.2 // indirect github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b // indirect - github.com/andybalholm/brotli v1.2.0 // indirect + github.com/andybalholm/brotli v1.2.8 // indirect github.com/apparentlymart/go-textseg/v15 v15.0.0 // indirect github.com/apparentlymart/go-textseg/v17 v17.0.1 // indirect github.com/aquasecurity/go-pep440-version v0.0.1 // indirect @@ -90,7 +90,7 @@ github.com/bgentry/go-netrc v0.0.0-20140422174119-9fd32a8b3d3d // indirect github.com/bitnami/go-version v0.0.0-20250131085805-b1f57a8634ef // indirect github.com/blakesmith/ar v0.0.0-20190502131153-809d4375e1fb // indirect - github.com/bmatcuk/doublestar/v4 v4.10.3 // indirect + github.com/bmatcuk/doublestar/v4 v4.10.4 // indirect github.com/bodgit/plumbing v1.3.0 // indirect github.com/bodgit/sevenzip v1.6.1 // indirect github.com/bodgit/windows v1.0.1 // indirect @@ -161,7 +161,7 @@ github.com/google/uuid v1.6.0 // indirect github.com/googleapis/enterprise-certificate-proxy v0.3.22 // indirect github.com/googleapis/gax-go/v2 v2.24.1 // indirect - github.com/gpustack/gguf-parser-go v0.27.0 // indirect + github.com/gpustack/gguf-parser-go v0.28.1 // indirect github.com/hashicorp/aws-sdk-go-base/v2 v2.0.0-beta.74 // indirect github.com/hashicorp/errwrap v1.1.0 // indirect github.com/hashicorp/go-cleanhttp v0.5.2 // indirect @@ -200,7 +200,7 @@ github.com/moby/moby/api v1.56.1 // indirect github.com/moby/moby/client v0.6.2 // indirect github.com/moby/sys/capability v0.4.0 // indirect - github.com/moby/sys/mountinfo v0.7.2 // indirect + github.com/moby/sys/mountinfo v0.7.3 // indirect github.com/moby/sys/signal v0.7.1 // indirect github.com/moby/sys/user v0.4.1 // indirect github.com/moby/sys/userns v0.2.1 // indirect @@ -285,12 +285,12 @@ go.opentelemetry.io/otel/trace v1.46.0 // indirect go.podman.io/image/v5 v5.42.0 // indirect go.podman.io/storage v1.65.0 // indirect - go.yaml.in/yaml/v3 v3.0.5 // indirect + go.yaml.in/yaml/v3 v3.0.6 // indirect go4.org v0.0.0-20230225012048-214862532bf5 // indirect golang.org/x/crypto v0.58.0 // indirect golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f // indirect golang.org/x/mod v0.42.0 // indirect - golang.org/x/net v0.61.0 // indirect + golang.org/x/net v0.62.0 // indirect golang.org/x/oauth2 v0.37.0 // indirect golang.org/x/sync v0.24.0 // indirect golang.org/x/sys v0.49.0 // indirect diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/grant-0.7.0/go.sum new/grant-0.7.1/go.sum --- old/grant-0.7.0/go.sum 2026-11-02 18:04:20.000000000 +0100 +++ new/grant-0.7.1/go.sum 2026-11-09 15:49:30.000000000 +0100 @@ -148,13 +148,13 @@ github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b/go.mod h1:Bkc+JYWjMCF8OyZ340IMSIi2Ebf3uwByOk6ho4wne1E= github.com/anchore/packageurl-go v0.2.0 h1:CkrM4RMUwrEGAiE1OVlxaZNzWj0TuHRey7o4T/EAErk= github.com/anchore/packageurl-go v0.2.0/go.mod h1:2JCgOQMIsqZ7TmliXG4PnUthPJAKE3mWQbsW2XHjAOE= -github.com/anchore/stereoscope v0.4.0 h1:MDL7YFRDaGzhCdjm/s+em1D/X9HwnZMYupfgg+mvqPI= -github.com/anchore/stereoscope v0.4.0/go.mod h1:hYJsi3M8a8N1O66u+rMQSgv5TREGM7QIjKBjPPnwiD8= -github.com/anchore/syft v1.56.0 h1:hpIzQsvlNPCgrz7KJZ79HX59I44yE/AyqTbvO5Q92jM= -github.com/anchore/syft v1.56.0/go.mod h1:xSTo7HeWF/zil0aQOTxwDjGZcN3GjM2X+hkHrMZs0Hk= +github.com/anchore/stereoscope v0.4.1 h1:7mxw24JCabbJIAcyvQDjBd2pbzo+0HSFVgjYlE8Zm+k= +github.com/anchore/stereoscope v0.4.1/go.mod h1:hYJsi3M8a8N1O66u+rMQSgv5TREGM7QIjKBjPPnwiD8= +github.com/anchore/syft v1.57.1 h1:lrbWhc8hbZJSKekMdB3PKetO0upE+lv9ihUfv9CXgfU= +github.com/anchore/syft v1.57.1/go.mod h1:PHj+bXUGr1sxpMLsuogjX86P5wZ+A+XZRY6WgfsIgnE= github.com/andreyvit/diff v0.0.0-20170406064948-c7f18ee00883/go.mod h1:rCTlJbsFo29Kk6CurOXKm700vrz8f0KW0JNfpkRJY/8= -github.com/andybalholm/brotli v1.2.0 h1:ukwgCxwYrmACq68yiUqwIWnGY0cTPox/M94sVwToPjQ= -github.com/andybalholm/brotli v1.2.0/go.mod h1:rzTDkvFWvIrjDXZHkuS16NPggd91W3kUSvPlQ1pLaKY= +github.com/andybalholm/brotli v1.2.8 h1:H9F6r7RNwzSRsx/lytpIYkbjNFMt2yNBwsJ2+0gpx78= +github.com/andybalholm/brotli v1.2.8/go.mod h1:rzTDkvFWvIrjDXZHkuS16NPggd91W3kUSvPlQ1pLaKY= github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be h1:9AeTilPcZAjCFIImctFaOjnTIavg87rW78vTPkQqLI8= github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be/go.mod h1:ySMOLuWl6zY27l47sB3qLNK6tF2fkHG55UZxx8oIVo4= github.com/antihax/optional v1.0.0/go.mod h1:uupD/76wgC+ih3iEmQUL+0Ugr19nfwCT1kdvxnR2qWY= @@ -223,8 +223,8 @@ github.com/bitnami/go-version v0.0.0-20250131085805-b1f57a8634ef/go.mod h1:9iglf1GG4oNRJ39bZ5AZrjgAFD2RwQbXw6Qf7Cs47wo= github.com/blakesmith/ar v0.0.0-20190502131153-809d4375e1fb h1:m935MPodAbYS46DG4pJSv7WO+VECIWUQ7OJYSoTrMh4= github.com/blakesmith/ar v0.0.0-20190502131153-809d4375e1fb/go.mod h1:PkYb9DJNAwrSvRx5DYA+gUcOIgTGVMNkfSCbZM8cWpI= -github.com/bmatcuk/doublestar/v4 v4.10.3 h1:1UIv1+fqH3++ViVkpnaPTB+Pi1UHycnPFAq14zgK+gI= -github.com/bmatcuk/doublestar/v4 v4.10.3/go.mod h1:xBQ8jztBU6kakFMg+8WGxn0c6z1fTSPVIjEY1Wr7jzc= +github.com/bmatcuk/doublestar/v4 v4.10.4 h1:oTKkRmRuOsKMqFe1AQazd9gGBFNEpOmgKp/xzB97dnA= +github.com/bmatcuk/doublestar/v4 v4.10.4/go.mod h1:xBQ8jztBU6kakFMg+8WGxn0c6z1fTSPVIjEY1Wr7jzc= github.com/bodgit/plumbing v1.3.0 h1:pf9Itz1JOQgn7vEOE7v7nlEfBykYqvUYioC61TwWCFU= github.com/bodgit/plumbing v1.3.0/go.mod h1:JOTb4XiRu5xfnmdnDJo6GmSbSbtSyufrsyZFByMtKEs= github.com/bodgit/sevenzip v1.6.1 h1:kikg2pUMYC9ljU7W9SaqHXhym5HyKm8/M/jd31fYan4= @@ -410,8 +410,8 @@ github.com/github/go-spdx/v2 v2.8.0/go.mod h1:Ftc45YYG1WzpzwEPKRVm9Jv8vDqOrN4gWoCkK+bHer0= github.com/gkampitakis/ciinfo v0.3.4 h1:5eBSibVuSMbb/H6Elc0IIEFbkzCJi3lm94n0+U7Z0KY= github.com/gkampitakis/ciinfo v0.3.4/go.mod h1:1NIwaOcFChN4fa/B0hEBdAb6npDlFL8Bwx4dfRLRqAo= -github.com/gkampitakis/go-snaps v0.5.24 h1:oyQ/CQA4s0nkVm6CLlM2GJSU8e4p6KGPZbrSCnTNBzE= -github.com/gkampitakis/go-snaps v0.5.24/go.mod h1:uy3lVzCCRRsAwYqSocyw5fY8xRLCYEfqoOJNxr8HonM= +github.com/gkampitakis/go-snaps v0.5.25 h1:ZE3iiQcS2WDV08JdUc+wVpHb6JEnLC+hlo9v8/YqZoQ= +github.com/gkampitakis/go-snaps v0.5.25/go.mod h1:uy3lVzCCRRsAwYqSocyw5fY8xRLCYEfqoOJNxr8HonM= github.com/glebarez/go-sqlite v1.23.0 h1:FyhIq4jqmgphQAUlY79zPldYGwISEZikaDfhiGWkkaI= github.com/glebarez/go-sqlite v1.23.0/go.mod h1:IIYrOH3L0rHY3jb4IXOHoWdklNajSGUN2eJcvK8WrnI= github.com/gliderlabs/ssh v0.3.8 h1:a4YXD1V7xMF9g5nTkdfnja3Sxy1PVDCj1Zg4Wb8vY6c= @@ -565,8 +565,8 @@ github.com/gookit/color v1.6.3/go.mod h1:9ACFc7/1IpHGBW8RwuDm/0YEnhg3dwwXpoMsmtyHfjs= github.com/gorilla/mux v1.8.1 h1:TuBL49tXwgrFYWhqrNgrUNEY92u81SPhu7sTdzQEiWY= github.com/gorilla/mux v1.8.1/go.mod h1:AKf9I4AEqPTmMytcMc0KkNouC66V3BtZ4qD5fmWSiMQ= -github.com/gpustack/gguf-parser-go v0.27.0 h1:eXFU9pmJEMQHOTL9qI742lXHWSa1CtlMWUU3gFce7nM= -github.com/gpustack/gguf-parser-go v0.27.0/go.mod h1:y4TwTtDqFWTK+xvprOjRUh+dowgU2TKCX37vRKvGiZ0= +github.com/gpustack/gguf-parser-go v0.28.1 h1:El6BAuJnpKI43nElOMc2erMtHQCv0ttu40WFJFf1Moo= +github.com/gpustack/gguf-parser-go v0.28.1/go.mod h1:y4TwTtDqFWTK+xvprOjRUh+dowgU2TKCX37vRKvGiZ0= github.com/grpc-ecosystem/grpc-gateway v1.16.0/go.mod h1:BDjrQk3hbvj6Nolgz8mAMFbcEtjT1g+wF4CSlocrBnw= github.com/hashicorp/aws-sdk-go-base/v2 v2.0.0-beta.74 h1:mymLUKThnV9wFvogOK8NnsMP9/vlhnjXY98gr2QIGW8= github.com/hashicorp/aws-sdk-go-base/v2 v2.0.0-beta.74/go.mod h1:Bh9qYL8ehmDxSg14Tk8oxFCP90XHfs6NxV1D84884xA= @@ -736,8 +736,8 @@ github.com/moby/moby/client v0.6.2/go.mod h1:DGcnO7qmPJrqobx/ggQgQ/AUk+2wgVdQv7uxB0/mEsc= github.com/moby/sys/capability v0.4.0 h1:4D4mI6KlNtWMCM1Z/K0i7RV1FkX+DBDHKVJpCndZoHk= github.com/moby/sys/capability v0.4.0/go.mod h1:4g9IK291rVkms3LKCDOoYlnV8xKwoDTpIrNEE35Wq0I= -github.com/moby/sys/mountinfo v0.7.2 h1:1shs6aH5s4o5H2zQLn796ADW1wMrIwHsyJ2v9KouLrg= -github.com/moby/sys/mountinfo v0.7.2/go.mod h1:1YOa8w8Ih7uW0wALDUgT1dTTSBrZ+HiBLGws92L2RU4= +github.com/moby/sys/mountinfo v0.7.3 h1:e0lin8d05kLgtUES/4cS/F70KlbZX/G3aZjLsV7WAgA= +github.com/moby/sys/mountinfo v0.7.3/go.mod h1:dEJRr+H+hx0lNG0BE+Smz95u/FDzjJv4/RjA2I456Iw= github.com/moby/sys/signal v0.7.1 h1:PrQxdvxcGijdo6UXXo/lU/TvHUWyPhj7UOpSo8tuvk0= github.com/moby/sys/signal v0.7.1/go.mod h1:Se1VGehYokAkrSQwL4tDzHvETwUZlnY7S5XtQ50mQp8= github.com/moby/sys/user v0.4.1 h1:RgjRlaDKi/Xmyrz4t8lyzXT6v2ooFeO/7xtchmhVWE0= @@ -1051,8 +1051,8 @@ go.uber.org/multierr v1.6.0/go.mod h1:cdWPpRnG4AhwMwsgIHip0KRBQjJy5kYEpYjJxpXp9iU= go.uber.org/zap v1.17.0/go.mod h1:MXVU+bhUf/A7Xi2HNOnopQOrmycQ5Ih87HtOu4q5SSo= go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg= -go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw= -go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg= +go.yaml.in/yaml/v3 v3.0.6 h1:zcDfvjXEqTQmpjniUBLc91xYJMB2c4QOFxEF/LCEckM= +go.yaml.in/yaml/v3 v3.0.6/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg= go4.org v0.0.0-20230225012048-214862532bf5 h1:nifaUDeh+rPaBCMPMQHZmvJf+QdpLFnuQPwx+LxVmtc= go4.org v0.0.0-20230225012048-214862532bf5/go.mod h1:F57wTi5Lrj6WLyswp5EYV1ncrEbFGHD4hhz6S1ZYeaU= golang.org/x/crypto v0.0.0-20180904163835-0709b304e793/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4= @@ -1167,8 +1167,8 @@ golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk= golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44= golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM= -golang.org/x/net v0.61.0 h1:RR+6j/BTBCrggOLugxa+66R8FvoN6MHlzDlZIbN9YFw= -golang.org/x/net v0.61.0/go.mod h1:WgDCOTH8iwtB66T4/GfI94AHo/hhdb7Hah9NDseQfiI= +golang.org/x/net v0.62.0 h1:18ELalfM5+XNRwzM2nYqXsZQ9ByS1uhj2O/U7+5jqRY= +golang.org/x/net v0.62.0/go.mod h1:WgDCOTH8iwtB66T4/GfI94AHo/hhdb7Hah9NDseQfiI= golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U= golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw= golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw= ++++++ grant.obsinfo ++++++ --- /var/tmp/diff_new_pack.KAp3g6/_old 2026-11-10 14:44:47.275543646 +0100 +++ /var/tmp/diff_new_pack.KAp3g6/_new 2026-11-10 14:44:47.278543771 +0100 @@ -1,5 +1,5 @@ name: grant -version: 0.7.0 -mtime: 1793639060 -commit: e37c45ee0bccc0daef8d82b5a1d28cce7fb20a9f +version: 0.7.1 +mtime: 1794235770 +commit: c87af8bb5165d4e9fe38b31c48d7eae4b4d68333 ++++++ vendor.tar.gz ++++++ /work/SRC/openSUSE:Factory/grant/vendor.tar.gz /work/SRC/openSUSE:Factory/.grant.new.3759290/vendor.tar.gz differ: char 133, line 1
