Merge pull request '- Fix CVEs' (#3) from eeich/mcphost:CVE_01_2026 into main

Reviewed-on: AI_MCP/mcphost#3
Reviewed-by: Christian Goll <cgoll@suse.com>

_service

@@ -0,0 +1,7 @@
+<services>
+ <service name="go_modules" mode="manual">
+  <param name="replace">
+   golang.org/x/crypto=golang.org/x/crypto@v0.45.0
+  </param>
+ </service>
+</services>

mcphost.changes

@@ -0,0 +1,219 @@
+-------------------------------------------------------------------
+Fri Jan  2 17:24:56 UTC 2026 - Egbert Eich <eich@suse.com>
+
+- Fix CVEs
+  * GO-2025-4135 (CVE-2025-47914)
+    SSH Agent servers do not validate the size of messages
+    when processing new identity requests, which may cause
+    the program to panic if the message is malformed due to
+    an out of bounds read.
+  * GO-2025-4116 (CVE-2025-47913)
+    SSH clients receiving SSH_AGENT_SUCCESS when expecting a
+    typed response will panic and cause early termination of
+    the client process.
+  * GO-2025-4134 (CVE-2025-58181, bsc#1253952).
+    SSH servers parsing GSSAPI authentication
+    requests do not validate the number of mechanisms
+    specified in the request, allowing an attacker to cause
+    unbounded memory consumption.
+
+-------------------------------------------------------------------
+Wed Dec 10 11:52:10 UTC 2025 - Darragh O'Reilly <doreilly@suse.com>
+
+- Update to 0.32.0
+  Feat: Add option to require approval before tool.
+  Bump github.com/cloudwego/eino to fix panic.
+  Changes to 0.31.4:
+  Update dependencies.
+  Changes to 0.31.3:
+  Fix format & update models.
+  Changes to 0.31.2:
+  Fix: suppress health check logging to debug output only/
+  Changes to 0.31.1:
+  Update dependency update mcp-go.
+
+-------------------------------------------------------------------
+Wed Nov  5 10:17:13 UTC 2025 - Sai Karthik Karra <kskarthik@disroot.org>
+
+- Add shell completions & basic %check during build time.
+
+-------------------------------------------------------------------
+Fri Oct 24 11:26:42 UTC 2025 - Ana Guerrero <ana.guerrero@suse.com>
+
+- Modernise packaging
+
+-------------------------------------------------------------------
+Fri Oct 10 12:43:31 UTC 2025 - Egbert Eich <eich@suse.com>
+
+- Peparing for submission to Factory:
+  * Clean up spec file, remove old tar balls.
+  * On SUSE use SUSE Golang build macros.
+
+-------------------------------------------------------------------
+Tue Oct  7 09:19:01 UTC 2025 - Matthias Eckermann <mge@suse.com>
+
+- Update to release 0.31.1
+
+-------------------------------------------------------------------
+Tue Oct  7 09:18:50 UTC 2025 - Matthias Eckermann <mge@suse.com>
+
+- Update to release 0.31.1
+
+-------------------------------------------------------------------
+Thu Sep 11 15:10:32 UTC 2025 - Matthias Eckermann <mge@suse.com>
+
+- Update to 0.31.0
+
+-------------------------------------------------------------------
+Tue Sep  2 11:54:21 UTC 2025 - Matthias Eckermann <mge@suse.com>
+
+- Update to 0.30.1
+
+-------------------------------------------------------------------
+Thu Aug 14 15:26:49 UTC 2025 - Matthias Eckermann <mge@suse.com>
+
+- Fix build
+
+-------------------------------------------------------------------
+Thu Aug 14 15:20:49 UTC 2025 - Matthias Eckermann <mge@suse.com>
+
+- Remove unnecessary .tidy.diff file
+
+-------------------------------------------------------------------
+Thu Aug 14 15:19:10 UTC 2025 - Matthias Eckermann <mge@suse.com>
+
+- Align on GO 1.24 not 1.24.5
+
+-------------------------------------------------------------------
+Thu Aug 14 15:18:56 UTC 2025 - Matthias Eckermann <mge@suse.com>
+
+- Align on GO 1.24 not 1.24.5
+
+-------------------------------------------------------------------
+Thu Aug 14 15:04:08 UTC 2025 - Matthias Eckermann <mge@suse.com>
+
+- Update to 0.29.0
+
+-------------------------------------------------------------------
+Mon Aug 11 11:59:00 UTC 2025 - Matthias Eckermann <mge@suse.com>
+
+- Update to 0.28.1
+
+-------------------------------------------------------------------
+Mon Jul 28 07:32:40 UTC 2025 - Matthias Eckermann <mge@suse.com>
+
+- Update to 0.26.1
+
+-------------------------------------------------------------------
+Wed Jul 23 12:18:46 UTC 2025 - Matthias Eckermann <mge@suse.com>
+
+- Update to 0.25.2
+
+-------------------------------------------------------------------
+Wed Jul 23 12:16:51 UTC 2025 - Matthias Eckermann <mge@suse.com>
+
+- Update to 0.25.2
+
+-------------------------------------------------------------------
+Wed Jul 23 09:42:23 UTC 2025 - Matthias Eckermann <mge@suse.com>
+
+- Add mcphost-0.25.1-tidy.diff
+
+-------------------------------------------------------------------
+Wed Jul 23 09:38:33 UTC 2025 - Matthias Eckermann <mge@suse.com>
+
+- Update to 0.25.1
+
+-------------------------------------------------------------------
+Wed Jul 16 11:40:57 UTC 2025 - Matthias Eckermann <mge@suse.com>
+
+- Update to 0.25.0, incl. SPEC File
+
+-------------------------------------------------------------------
+Wed Jul 16 11:40:27 UTC 2025 - Matthias Eckermann <mge@suse.com>
+
+- Update to 0.25.0
+
+-------------------------------------------------------------------
+Thu Jul 10 09:04:16 UTC 2025 - Matthias Eckermann <mge@suse.com>
+
+- Make 0.21.0 build
+
+-------------------------------------------------------------------
+Thu Jul 10 08:59:47 UTC 2025 - Matthias Eckermann <mge@suse.com>
+
+- Make 0.21.0 build
+
+-------------------------------------------------------------------
+Thu Jul 10 08:59:18 UTC 2025 - Matthias Eckermann <mge@suse.com>
+
+- Make 0.21.0 build
+
+-------------------------------------------------------------------
+Thu Jul 10 08:16:54 UTC 2025 - Matthias Eckermann <mge@suse.com>
+
+- Update to 0.21.0
+
+-------------------------------------------------------------------
+Wed Jul  9 09:36:42 UTC 2025 - Matthias Eckermann <mge@suse.com>
+
+- Update to 0.20.0 
+
+-------------------------------------------------------------------
+Tue Jul  1 07:41:09 UTC 2025 - Matthias Eckermann <mge@suse.com>
+
+- Update to 0.19.2
+
+-------------------------------------------------------------------
+Sat Jun 28 08:42:19 UTC 2025 - Matthias Eckermann <mge@suse.com>
+
+- Update to 0.19.0
+
+-------------------------------------------------------------------
+Wed Jun 25 01:16:42 UTC 2025 - Matthias Eckermann <mge@suse.com>
+
+- Add proper license information
+
+-------------------------------------------------------------------
+Tue Jun 24 11:30:28 UTC 2025 - Matthias Eckermann <mge@suse.com>
+
+- Update to 0.15.0: Add Azure OpenAI provider
+
+-------------------------------------------------------------------
+Fri Jun 20 14:27:12 UTC 2025 - Matthias Eckermann <mge@suse.com>
+
+- Update to 0.14.1 
+
+-------------------------------------------------------------------
+Wed Jun 18 23:19:08 UTC 2025 - Matthias Eckermann <mge@suse.com>
+
+- Update .spec file to 0.14.0 
+
+-------------------------------------------------------------------
+Wed Jun 18 23:12:52 UTC 2025 - Matthias Eckermann <mge@suse.com>
+
+-  Update to 0.14.0
+
+-------------------------------------------------------------------
+Tue Jun 17 07:46:16 UTC 2025 - Matthias Eckermann <mge@suse.com>
+
+- Update to 0.13.0 
+
+-------------------------------------------------------------------
+Mon Jun 16 13:15:46 UTC 2025 - Matthias Eckermann <mge@suse.com>
+
+- Update GOlang dependency to >= 1.24 
+
+-------------------------------------------------------------------
+Mon Jun 16 11:41:10 UTC 2025 - Matthias Eckermann <mge@suse.com>
+
+- Update to 0.12.4 
+
+-------------------------------------------------------------------
+Tue Jun 10 04:58:43 PM CEST 2025 - Matthias G. Eckermann <mge@suse.com>
+
+- Update to 0.11.2
+-------------------------------------------------------------------
+Wed May 21 12:46:50 UTC 2025 - Daniel Garcia <daniel.garcia@suse.com>
+
+- Initial version 0.7.1

mcphost.spec

@@ -0,0 +1,102 @@
+#
+# spec file for package mcphost
+#
+# Copyright (c) 2025 SUSE LLC
+#
+# All modifications and additions to the file contributed by third parties
+# remain the property of their copyright owners, unless otherwise agreed
+# upon. The license for this file, and modifications and additions to the
+# file, is the same license as for the pristine package itself (unless the
+# license for the pristine package is not an Open Source License, in which
+# case the license is the MIT License). An "Open Source License" is a
+# license that conforms to the Open Source Definition (Version 1.9)
+# published by the Open Source Initiative.
+
+# Please submit bugfixes or comments via https://bugs.opensuse.org/
+#
+
+Name:           mcphost
+Version:        0.32.0
+Release:        0
+Summary:        A CLI host application for the Model Context Protocol (MCP)
+License:        MIT and Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause
+URL:            https://github.com/mark3labs/mcphost
+Source0:        https://github.com/mark3labs/mcphost/archive/refs/tags/v%{version}.tar.gz#/%{name}-%{version}.tar.gz
+Source1:        vendor.tar.gz
+BuildRequires:  golang(API) >= 1.24
+
+%description
+A CLI host application that enables Large Language Models (LLMs) to interact
+with external tools through the Model Context Protocol (MCP). Currently
+supports both Claude 3.5 Sonnet and Ollama models.
+
+%package bash-completion
+Summary:        Bash Completion for %{name}
+Group:          System/Shells
+Requires:       bash-completion
+BuildArch:      noarch
+Requires:       %{name}
+Supplements:    (%{name} and bash-completion)
+
+%description bash-completion
+The official bash completion script for %{name}, generated during the build.
+
+%package zsh-completion
+Summary:        ZSH Completion for %{name}
+Group:          System/Shells
+BuildArch:      noarch
+Requires:       %{name}
+Supplements:    (%{name} and zsh)
+
+%description zsh-completion
+The official zsh completion script for %{name}, generated during the build.
+
+%package fish-completion
+Summary:        Fish Completion for %{name}
+Group:          System/Shells
+BuildArch:      noarch
+Requires:       %{name}
+Supplements:    (%{name} and fish)
+
+%description fish-completion
+The official fish completion script for %{name}, generated during the build.
+
+%prep
+%autosetup -a 1
+
+%build
+go build \
+       -mod=vendor \
+       -buildmode=pie
+
+%install
+install -D -m 0755 %{name} "%{buildroot}%{_bindir}/%{name}"
+
+# Build the shell autocomplete files
+%{buildroot}/%{_bindir}/%{name} completion bash > %{name}-autocomplete.bash
+%{buildroot}/%{_bindir}/%{name} completion zsh > %{name}-autocomplete.zsh
+%{buildroot}/%{_bindir}/%{name} completion fish > %{name}-autocomplete.fish
+
+# Install the shell autocomplete files
+install -Dm 644 %{name}-autocomplete.bash %{buildroot}%{_datadir}/bash-completion/completions/%{name}
+install -Dm 644 %{name}-autocomplete.zsh %{buildroot}%{_datadir}/zsh/site-functions/_%{name}
+install -Dm 644 %{name}-autocomplete.fish %{buildroot}%{_datadir}/fish/completions/_%{name}
+
+%check
+# execute the binary as a basic check
+%{buildroot}/%{_bindir}/%{name} help
+
+%files
+%license LICENSE
+%{_bindir}/%{name}
+# completions
+%files bash-completion
+%{_datadir}/bash-completion
+
+%files zsh-completion
+%{_datadir}/zsh
+
+%files fish-completion
+%{_datadir}/fish
+
+%changelog