forked from products/PackageHub
Compare commits
1 Commits
workflow
...
maintenanc
| Author | SHA256 | Date | |
|---|---|---|---|
| 3e7d3031ed |
4
.gitmodules
vendored
4
.gitmodules
vendored
@@ -17350,10 +17350,6 @@
|
||||
path = rasqal
|
||||
url = ../../pool/rasqal
|
||||
branch = leap-16.0
|
||||
[submodule "rawtherapee"]
|
||||
path = rawtherapee
|
||||
url = ../../pool/rawtherapee
|
||||
branch = leap-16.0
|
||||
[submodule "raw-thumbnailer"]
|
||||
path = raw-thumbnailer
|
||||
url = ../../pool/raw-thumbnailer
|
||||
|
||||
2
chromium
2
chromium
Submodule chromium updated: 63710dd6ca...f6c3bfa54e
Submodule cmake-extras updated: ff796226d9...d3c9c9090d
2
exim
2
exim
Submodule exim updated: aa2daa7cec...9f3f61dcb2
2
hauler
2
hauler
Submodule hauler updated: 4061841edd...9084f004c1
2
labwc
2
labwc
Submodule labwc updated: 54ed9a7fa2...3ff4d66043
@@ -1,14 +0,0 @@
|
||||
<patchinfo incident="packagehub-49">
|
||||
<packager>okurz</packager>
|
||||
<rating>moderate</rating>
|
||||
<category>recommended</category>
|
||||
<summary>Recommended update for perl-Mojolicious-Plugin-Webpack</summary>
|
||||
<description>This update for perl-Mojolicious-Plugin-Webpack fixes the following issues:
|
||||
|
||||
Changes in perl-Mojolicious-Plugin-Webpack:
|
||||
|
||||
- See https://github.com/jhthorsen/mojolicious-plugin-webpack/pull/17
|
||||
</description>
|
||||
<package>perl-Mojolicious-Plugin-Webpack</package>
|
||||
|
||||
</patchinfo>
|
||||
@@ -1,209 +0,0 @@
|
||||
<patchinfo incident="packagehub-54">
|
||||
<issue tracker="bnc" id="1251651">VUL-0: CVE-2025-58190: hauler: golang.org/x/net/html: excessive memory consumption by `html.ParseFragment` when processing specially crafted input</issue>
|
||||
<issue tracker="cve" id="2025-22872">cve#2025-22872 not resolved: 404 Client Error: Not Found for url: https://bugzilla.suse.com/api2/issues/?references__name=CVE-2025-22872</issue>
|
||||
<issue tracker="cve" id="2025-58058">cve#2025-58058 not resolved: 404 Client Error: Not Found for url: https://bugzilla.suse.com/api2/issues/?references__name=CVE-2025-58058</issue>
|
||||
<issue tracker="cve" id="2024-45338">cve#2024-45338 not resolved: 404 Client Error: Not Found for url: https://bugzilla.suse.com/api2/issues/?references__name=CVE-2024-45338</issue>
|
||||
<issue tracker="bnc" id="1241184">VUL-0: CVE-2024-0406: hauler: mholt/archiver: access to restricted files or directories when unpacking specially crafted tar file</issue>
|
||||
<issue tracker="bnc" id="1235332">VUL-0: CVE-2024-45338: hauler: golang.org/x/net/html: denial of service due to non-linear parsing of case-insensitive content</issue>
|
||||
<issue tracker="cve" id="2025-11579">cve#2025-11579 not resolved: 404 Client Error: Not Found for url: https://bugzilla.suse.com/api2/issues/?references__name=CVE-2025-11579</issue>
|
||||
<issue tracker="cve" id="2024-0406">cve#2024-0406 not resolved: 404 Client Error: Not Found for url: https://bugzilla.suse.com/api2/issues/?references__name=CVE-2024-0406</issue>
|
||||
<issue tracker="cve" id="2025-47911">cve#2025-47911 not resolved: 404 Client Error: Not Found for url: https://bugzilla.suse.com/api2/issues/?references__name=CVE-2025-47911</issue>
|
||||
<issue tracker="cve" id="2025-46569">cve#2025-46569 not resolved: 404 Client Error: Not Found for url: https://bugzilla.suse.com/api2/issues/?references__name=CVE-2025-46569</issue>
|
||||
<issue tracker="bnc" id="1246722">VUL-0: CVE-2025-46569: hauler: github.com/open-policy-agent/opa: HTTP request path can be crafted to inject Rego code into a constructed query when a virtual document is requested through the Data API</issue>
|
||||
<issue tracker="bnc" id="1248937">VUL-0: CVE-2025-58058: hauler: github.com/ulikunitz/xz: github.com/ulikunitz/xz leaks memory</issue>
|
||||
<issue tracker="bnc" id="1241804">VUL-0: CVE-2025-22872: hauler: golang.org/x/net/html: incorrectly interpreted tags can cause content to be placed wrong scope during DOM construction</issue>
|
||||
<issue tracker="bnc" id="1251516">VUL-0: CVE-2025-47911: hauler: golang.org/x/net/html: various algorithms with quadratic complexity when parsing HTML documents</issue>
|
||||
<issue tracker="cve" id="2025-58190">cve#2025-58190 not resolved: 404 Client Error: Not Found for url: https://bugzilla.suse.com/api2/issues/?references__name=CVE-2025-58190</issue>
|
||||
<issue tracker="bnc" id="1251891">VUL-0: CVE-2025-11579: hauler: github.com/nwaples/rardecode: failure to restrict the dictionary size when processing RAR files allows for excessive memory consumpti</issue>
|
||||
<packager>dirkmueller</packager>
|
||||
<rating>important</rating>
|
||||
<category>security</category>
|
||||
<summary>Security update for hauler</summary>
|
||||
<description>This update for hauler fixes the following issues:
|
||||
|
||||
- Update to version 1.3.1 (bsc#1251516, CVE-2025-47911,
|
||||
bsc#1251891, CVE-2025-11579, bsc#1251651, CVE-2025-58190,
|
||||
bsc#1248937, CVE-2025-58058):
|
||||
* bump github.com/containerd/containerd (#474)
|
||||
* another fix to tests for new tests (#472)
|
||||
* fixed typo in testdata (#471)
|
||||
* fixed/cleaned new tests (#470)
|
||||
* trying a new way for hauler testing (#467)
|
||||
* update for cosign v3 verify (#469)
|
||||
* added digests view to info (#465)
|
||||
* bump github.com/nwaples/rardecode/v2 from 2.1.1 to 2.2.0 in the go_modules group across 1 directory (#457)
|
||||
* update oras-go to v1.2.7 for security patches (#464)
|
||||
* update cosign to v3.0.2+hauler.1 (#463)
|
||||
* fixed homebrew directory deprecation (#462)
|
||||
* add registry logout command (#460)
|
||||
|
||||
- Update to version 1.3.0:
|
||||
* bump the go_modules group across 1 directory with 2 updates (#455)
|
||||
* upgraded versions/dependencies/deprecations (#454)
|
||||
* allow loading of docker tarballs (#452)
|
||||
* bump the go_modules group across 1 directory with 2 updates (#449)
|
||||
|
||||
- update to 1.2.5 (bsc#1246722, CVE-2025-46569):
|
||||
* Bump github.com/open-policy-agent/opa from 1.1.0 to 1.4.0 in
|
||||
the go_modules group across 1 directory (CVE-2025-46569)
|
||||
* deprecate auth from hauler store copy
|
||||
* Bump github.com/cloudflare/circl from 1.3.7 to 1.6.1 in the
|
||||
go_modules group across 1 directory
|
||||
* Bump github.com/go-viper/mapstructure/v2 from 2.2.1 to 2.3.0
|
||||
in the go_modules group across 1 directory
|
||||
* upgraded go and dependencies versions
|
||||
|
||||
- Update to version 1.2.5:
|
||||
* upgraded go and dependencies versions (#444)
|
||||
* Bump github.com/go-viper/mapstructure/v2 (#442)
|
||||
* bump github.com/cloudflare/circl (#441)
|
||||
* deprecate auth from hauler store copy (#440)
|
||||
* Bump github.com/open-policy-agent/opa (#438)
|
||||
|
||||
- update to 1.2.4 (CVE-2025-22872, bsc#1241804):
|
||||
* Bump golang.org/x/net from 0.37.0 to 0.38.0 in the go_modules
|
||||
group across 1 directory
|
||||
* minor tests updates
|
||||
|
||||
- Update to version 1.2.3:
|
||||
* formatting and flag text updates
|
||||
* add keyless signature verification (#434)
|
||||
* bump helm.sh/helm/v3 in the go_modules group across 1 directory (#430)
|
||||
* add --only flag to hauler store copy (for images) (#429)
|
||||
* fix tlog verification error/warning output (#428)
|
||||
|
||||
- Update to version 1.2.2 (bsc#1241184, CVE-2024-0406):
|
||||
* cleanup new tlog flag typos and add shorthand (#426)
|
||||
* default public transparency log verification to false to be airgap friendly but allow override (#425)
|
||||
* bump github.com/golang-jwt/jwt/v4 (#423)
|
||||
* bump the go_modules group across 1 directory with 2 updates (#422)
|
||||
* bump github.com/go-jose/go-jose/v3 (#417)
|
||||
* bump github.com/go-jose/go-jose/v4 (#415)
|
||||
* clear default manifest name if product flag used with sync (#412)
|
||||
* updates for v1.2.0 (#408)
|
||||
* fixed remote code (#407)
|
||||
* added remote file fetch to load (#406)
|
||||
* added remote and multiple file fetch to sync (#405)
|
||||
* updated save flag and related logs (#404)
|
||||
* updated load flag and related logs [breaking change] (#403)
|
||||
* updated sync flag and related logs [breaking change] (#402)
|
||||
* upgraded api update to v1/updated dependencies (#400)
|
||||
* fixed consts for oci declarations (#398)
|
||||
* fix for correctly grabbing platform post cosign 2.4 updates (#393)
|
||||
* use cosign v2.4.1+carbide.2 to address containerd annotation in index.json (#390)
|
||||
* Bump the go_modules group across 1 directory with 2 updates (#385)
|
||||
* replace mholt/archiver with mholt/archives (#384)
|
||||
* forked cosign bump to 2.4.1 and use as a library vs embedded binary (#383)
|
||||
* cleaned up registry and improved logging (#378)
|
||||
* Bump golang.org/x/crypto in the go_modules group across 1 directory (#377)
|
||||
- bump net/html dependencies (bsc#1235332, CVE-2024-45338)
|
||||
|
||||
- Update to version 1.1.1:
|
||||
* fixed cli desc for store env var (#374)
|
||||
* updated versions for go/k8s/helm (#373)
|
||||
* updated version flag to internal/flags (#369)
|
||||
* renamed incorrectly named consts (#371)
|
||||
* added store env var (#370)
|
||||
* adding ignore errors and retries for continue on error/fail on error (#368)
|
||||
* updated/fixed hauler directory (#354)
|
||||
* standardize consts (#353)
|
||||
* removed cachedir code (#355)
|
||||
* removed k3s code (#352)
|
||||
* updated dependencies for go, helm, and k8s (#351)
|
||||
* [feature] build with boring crypto where available (#344)
|
||||
* updated workflow to goreleaser builds (#341)
|
||||
* added timeout to goreleaser workflow (#340)
|
||||
* trying new workflow build processes (#337)
|
||||
* improved workflow performance (#336)
|
||||
* have extract use proper ref (#335)
|
||||
* yet another workflow goreleaser fix (#334)
|
||||
* even more workflow fixes (#333)
|
||||
* added more fixes to github workflow (#332)
|
||||
* fixed typo in hauler store save (#331)
|
||||
* updates to fix build processes (#330)
|
||||
* added integration tests for non hauler tarballs (#325)
|
||||
* bump: golang >= 1.23.1 (#328)
|
||||
* add platform flag to store save (#329)
|
||||
* Update feature_request.md
|
||||
* updated/standardize command descriptions (#313)
|
||||
* use new annotation for 'store save' manifest.json (#324)
|
||||
* enable docker load for hauler tarballs (#320)
|
||||
* bump to cosign v2.2.3-carbide.3 for new annotation (#322)
|
||||
* continue on error when adding images to store (#317)
|
||||
* Update README.md (#318)
|
||||
* fixed completion commands (#312)
|
||||
* github.com/rancherfederal/hauler => hauler.dev/go/hauler (#311)
|
||||
* pages: enable go install hauler.dev/go/hauler (#310)
|
||||
* Create CNAME
|
||||
* pages: initial workflow (#309)
|
||||
* testing and linting updates (#305)
|
||||
* feat-273: TLS Flags (#303)
|
||||
* added list-repos flag (#298)
|
||||
* fixed hauler login typo (#299)
|
||||
* updated cobra function for shell completion (#304)
|
||||
* updated install.sh to remove github api (#293)
|
||||
* fix image ref keys getting squashed when containing sigs/atts (#291)
|
||||
* fix missing versin info in release build (#283)
|
||||
* bump github.com/docker/docker in the go_modules group across 1 directory (#281)
|
||||
* updated install script (`install.sh`) (#280)
|
||||
* fix digest images being lost on load of hauls (Signed). (#259)
|
||||
* feat: add readonly flag (#277)
|
||||
* fixed makefile for goreleaser v2 changes (#278)
|
||||
* updated goreleaser versioning defaults (#279)
|
||||
* update feature_request.md (#274)
|
||||
* updated old references
|
||||
* updated actions workflow user
|
||||
* added dockerhub to github actions workflow
|
||||
* removed helm chart
|
||||
* added debug container and workflow
|
||||
* updated products flag description
|
||||
* updated chart for release
|
||||
* fixed workflow errors/warnings
|
||||
* fixed permissions on testdata
|
||||
* updated chart versions (will need to update again)
|
||||
* last bit of fixes to workflow
|
||||
* updated unit test workflow
|
||||
* updated goreleaser deprecations
|
||||
* added helm chart release job
|
||||
* updated github template names
|
||||
* updated imports (and go fmt)
|
||||
* formatted gitignore to match dockerignore
|
||||
* formatted all code (go fmt)
|
||||
* updated chart tests for new features
|
||||
* Adding the timeout flag for fileserver command
|
||||
* Configure chart commands to use helm clients for OCI and private registry support
|
||||
* Added some documentation text to sync command
|
||||
* Bump golang.org/x/net from 0.17.0 to 0.23.0
|
||||
* fix for dup digest smashing in cosign
|
||||
* removed vagrant scripts
|
||||
* last bit of updates and formatting of chart
|
||||
* updated hauler testdata
|
||||
* adding functionality and cleaning up
|
||||
* added initial helm chart
|
||||
* removed tag in release workflow
|
||||
* updated/fixed image ref in release workflow
|
||||
* updated/fixed platforms in release workflow
|
||||
* updated/cleaned github actions (#222)
|
||||
* Make Product Registry configurable (#194)
|
||||
* updated fileserver directory name (#219)
|
||||
* fix logging for files
|
||||
* add extra info for the tempdir override flag
|
||||
* tempdir override flag for load
|
||||
* deprecate the cache flag instead of remove
|
||||
* switch to using bci-golang as builder image
|
||||
* fix: ensure /tmp for hauler store load
|
||||
* added the copy back for now
|
||||
* remove copy at the image sync not needed with cosign update
|
||||
* removed misleading cache flag
|
||||
* better logging when adding to store
|
||||
* update to v2.2.3 of our cosign fork
|
||||
* add: dockerignore
|
||||
* add: Dockerfile
|
||||
* Bump google.golang.org/protobuf from 1.31.0 to 1.33.0
|
||||
* Bump github.com/docker/docker
|
||||
* updated and added new logos
|
||||
* updated github files
|
||||
</description>
|
||||
<package>hauler</package>
|
||||
<seperate_build_arch/>
|
||||
</patchinfo>
|
||||
@@ -1,127 +0,0 @@
|
||||
<patchinfo incident="packagehub-51">
|
||||
<packager>dirkmueller</packager>
|
||||
<rating>moderate</rating>
|
||||
<category>recommended</category>
|
||||
<summary>Recommended update for trivy</summary>
|
||||
<description>This update for trivy fixes the following issues:
|
||||
|
||||
Changes in trivy:
|
||||
|
||||
Update to version 0.68.1:
|
||||
|
||||
* fix: update cosing settings for GoReleaser after bumping cosing to v3 (#9863)
|
||||
* chore(deps): bump the testcontainers group with 2 updates (#9506)
|
||||
* feat(aws): Add support for dualstack ECR endpoints (#9862)
|
||||
* fix(vex): use a separate `visited` set for each DFS path (#9760)
|
||||
* docs: catch some missed docs -> guide (#9850)
|
||||
* refactor(misconf): parse azure_policy_enabled to addonprofile.azurepolicy.enabled (#9851)
|
||||
* chore(cli): Remove Trivy Cloud (#9847)
|
||||
* fix(misconf): ensure value used as ignore marker is non-null and known (#9835)
|
||||
* fix(misconf): map healthcheck start period flag to --start-period instead of --startPeriod (#9837)
|
||||
* chore(deps): bump the docker group with 3 updates (#9776)
|
||||
* chore(deps): bump golang.org/x/crypto from 0.41.0 to 0.45.0 (#9827)
|
||||
* chore(deps): bump the common group across 1 directory with 20 updates (#9840)
|
||||
* feat(image): add Sigstore bundle SBOM support (#9516)
|
||||
* chore(deps): bump the aws group with 7 updates (#9691)
|
||||
* test(k8s): update k8s integrtion test (#9725)
|
||||
* chore(deps): bump github.com/containerd/containerd from 1.7.28 to 1.7.29 (#9764)
|
||||
* feat(sbom): add support for SPDX attestations (#9829)
|
||||
* docs(misconf): Remove duplicate sections (#9819)
|
||||
* feat(misconf): Update Azure network schema for new checks (#9791)
|
||||
* feat(misconf): Update AppService schema (#9792)
|
||||
* fix(misconf): ensure boolean metadata values are correctly interpreted (#9770)
|
||||
* feat(misconf): support https_traffic_only_enabled in Az storage account (#9784)
|
||||
* docs: restructure docs for new hosting (#9799)
|
||||
* docs(server): fix info about scanning licenses on the client side. (#9805)
|
||||
* ci: remove unused preinstalled software/images for build tests to free up disk space. (#9814)
|
||||
* feat(report): add fingerprint generation for vulnerabilities (#9794)
|
||||
* chore: trigger the trivy-www workflow (#9737)
|
||||
* fix: update all documentation links (#9777)
|
||||
* feat(suse): Add new openSUSE, Micro and SLES releases end of life dates (#9788)
|
||||
* test(go): set `GOPATH` for tests (#9785)
|
||||
* feat(flag): add `--cacert` flag (#9781)
|
||||
* fix(misconf): handle unsupported experimental flags in Dockerfile (#9769)
|
||||
* test(go): refactor mod_test.go to use txtar format (#9775)
|
||||
* docs: Fix typos and linguistic errors in documentation / hacktoberfest (#9586)
|
||||
* chore(deps): bump github.com/opencontainers/selinux from 1.12.0 to 1.13.0 (#9778)
|
||||
* chore(deps): bump github.com/containerd/containerd/v2 from 2.1.4 to 2.1.5 (#9763)
|
||||
* fix(java): use `true` as default value for Repository Release|Snapshot Enabled in pom.xml and settings.xml files (#9751)
|
||||
* docs: add info that `SSL_CERT_FILE` works on `Unix systems other than macOS` only (#9772)
|
||||
* docs: change SecObserve URLs in documentatio (#9771)
|
||||
* feat(db): enable concurrent access to vulnerability database (#9750)
|
||||
* feat(misconf): add agentpools to azure container schema (#9714)
|
||||
* feat(report): switch ReportID from UUIDv4 to UUIDv7 (#9749)
|
||||
* feat(misconf): Update Azure Compute schema (#9675)
|
||||
* feat(misconf): Update azure storage schema (#9728)
|
||||
* feat(misconf): Update SecurityCenter schema (#9674)
|
||||
* feat(image): pass global context to docker/podman image save func (#9733)
|
||||
* chore(deps): bump the github-actions group with 4 updates (#9739)
|
||||
* fix(flag): remove viper.SetDefault to fix IsSet() for config-only flags (#9732)
|
||||
* feat(license): use separate SPDX ids to ignore SPDX expressions (#9087)
|
||||
* feat(dotnet): add dependency graph support for .deps.json files (#9726)
|
||||
* feat(misconf): Add support for configurable Rego error limit (#9657)
|
||||
* feat(misconf): Add RoleAssignments attribute (#9396)
|
||||
* feat(report): add image reference to report metadata (#9729)
|
||||
* fix(os): Add photon 5.0 in supported OS (#9724)
|
||||
* fix(license): handle SPDX WITH exceptions as single license in category detection (#9380)
|
||||
* refactor: add case-insensitive string set implementation (#9720)
|
||||
* feat: include registry and repository in artifact ID calculation (#9689)
|
||||
* feat(java): add support remote repositories from settings.xml files (#9708)
|
||||
* fix(sbom): don’t panic on SBOM format if scanned CycloneDX file has empty metadata (#9562)
|
||||
* docs: update vulnerability reporting guidelines in SECURITY.md (#9395)
|
||||
* docs: add info about `java-db` subdir (#9706)
|
||||
* fix(report): correct field order in SARIF license results (#9712)
|
||||
* test: improve golden file management in integration tests (#9699)
|
||||
* ci: get base_sha using base.ref (#9704)
|
||||
* refactor(misconf): mark AVDID fields as deprecated and use ID internally (#9576)
|
||||
* fix(nodejs): fix npmjs parser.pkgNameFromPath() panic issue (#9688)
|
||||
* fix: close all opened resources if an error occurs (#9665)
|
||||
* refactor(misconf): type-safe parser results in generic scanner (#9685)
|
||||
* feat(image): add RepoTags support for Docker archives (#9690)
|
||||
* chore(deps): bump github.com/quic-go/quic-go from 0.52.0 to 0.54.1 (#9694)
|
||||
* feat(misconf): Update Azure Container Schema (#9673)
|
||||
* ci: use merge commit for apidiff to avoid false positives (#9622)
|
||||
* feat(misconf): include map key in manifest snippet for diagnostics (#9681)
|
||||
* refactor(misconf): add ManifestFromYAML for unified manifest parsing (#9680)
|
||||
* test: update golden files for TestRepository* integration tests (#9684)
|
||||
* refactor(cli): Update the cloud config command (#9676)
|
||||
* fix(sbom): add `buildInfo` info as properties (#9683)
|
||||
* feat: add ReportID field to scan reports (#9670)
|
||||
* docs: add vulnerability database contribution guide (#9667)
|
||||
* feat(cli): Add trivy cloud suppport (#9637)
|
||||
* feat: add ArtifactID field to uniquely identify scan targets (#9663)
|
||||
* fix(nodejs): use the default ID format to match licenses in pnpm packages. (#9661)
|
||||
* feat(sbom): use SPDX license IDs list to validate SPDX IDs (#9569)
|
||||
* fix: use context for analyzers (#9538)
|
||||
* chore(deps): bump the docker group with 3 updates (#9545)
|
||||
* chore(deps): bump the aws group with 6 updates (#9547)
|
||||
* ci(helm): bump Trivy version to 0.67.2 for Trivy Helm Chart 0.19.1 (#9641)
|
||||
* test(helm): bump up Yamale dependency for Helm chart-testing-action (#9653)
|
||||
* fix: Trim the end-of-range suffix (#9618)
|
||||
* test(k8s): use a specific bundle for k8s misconfig scan (#9633)
|
||||
* fix: Use `fetch-level: 1` to check out trivy-repo in the release workflow (#9636)
|
||||
* refactor: move the aws config (#9617)
|
||||
* fix(license): don't normalize `unlicensed` licenses into `unlicense` (#9611)
|
||||
* fix: using SrcVersion instead of Version for echo detector (#9552)
|
||||
* feat(fs): change artifact type to repository when git info is detected (#9613)
|
||||
* fix: add `buildInfo` for `BlobInfo` in `rpc` package (#9608)
|
||||
* fix(vex): don't use reused BOM (#9604)
|
||||
* ci: use pull_request_target for apidiff workflow to support fork PRs (#9605)
|
||||
* fix: restore compatibility for google.protobuf.Value (#9559)
|
||||
* ci: add API diff workflow (#9600)
|
||||
* chore(deps): update to module-compatible docker-credential-gcr/v2 (#9591)
|
||||
* docs: improve documentation for scanning raw IaC configurations (#9571)
|
||||
* feat: allow ignoring findings by type in Rego (#9578)
|
||||
* docs: bump pygments from 2.18.0 to 2.19.2 (#9596)
|
||||
* refactor(misconf): add ID to scan.Rule (#9573)
|
||||
* fix(java): update order for resolving package fields from multiple demManagement (#9575)
|
||||
* chore(deps): bump the github-actions group across 1 directory with 9 updates (#9563)
|
||||
* chore(deps): bump the common group across 1 directory with 7 updates (#9590)
|
||||
* chore(deps): Switch to go-viper/mapstructure (#9579)
|
||||
* chore: add context to the cache interface (#9565)
|
||||
* ci(helm): bump Trivy version to 0.67.0 for Trivy Helm Chart 0.19.0 (#9554)
|
||||
* fix: validate backport branch name (#9548)
|
||||
</description>
|
||||
<package>trivy</package>
|
||||
<seperate_build_arch/>
|
||||
</patchinfo>
|
||||
209
patchinfo.20251208125101589983.93181000773252/_patchinfo
Normal file
209
patchinfo.20251208125101589983.93181000773252/_patchinfo
Normal file
@@ -0,0 +1,209 @@
|
||||
<patchinfo>
|
||||
<issue tracker="bnc" id="1250352">Package rpcs3 fails to build for Tumbleweed</issue>
|
||||
<packager>regularhunter</packager>
|
||||
<rating>moderate</rating>
|
||||
<category>recommended</category>
|
||||
<summary>Recommended update for rpcs3</summary>
|
||||
<description>This update for rpcs3 fixes the following issues:
|
||||
|
||||
Changes in rpcs3:
|
||||
|
||||
- Update to 0.0.38~git20251029:
|
||||
* Qt: fix TSX warning style
|
||||
* VK: cache recording image
|
||||
* GL: flip overlays vertically during recordings
|
||||
* GL: only create new texture when necessary
|
||||
* VK: add memory barriers to copy_image
|
||||
* overlays: add record with overlays setting to settings dialog
|
||||
* overlays: add record with overlays setting to home menu
|
||||
* Vk: allow to record overlays
|
||||
* GL: allow to record overlays
|
||||
* Add new option for recording overlays
|
||||
* Use move semantics for present_frame
|
||||
* Update fusion to 1.2.9
|
||||
* [openal-soft] Fix malloc/free in fmtlib
|
||||
* vk: Filter out re-bar usage from memory pressure watchdog
|
||||
* SaveStates/SPU-LLVM: Fix SPU Access Violations on load
|
||||
* vk: Make best-effort attempt to utilize the low-latency pool
|
||||
* vm: Deallocate memory early, check no PS3 memory leaks
|
||||
* More communication id validation changes
|
||||
* Improve sceNpSignalingGetLocalNetInfo
|
||||
* Fix build with Qt 6.10
|
||||
* Relax SceNpCommunicationId validation
|
||||
* SaveState Manager: Add option to boot last savestate
|
||||
* SaveState Manager: Format specially close dates
|
||||
* SaveState Manager: Fix game specific filtering
|
||||
* vk: Do not access async scheduler if not explicitly initialized
|
||||
* vk: Fix broken bound object comparison
|
||||
* vk: Make buffer objects uniquely identifiable
|
||||
* vk: Use unique resource ids on buffer views
|
||||
* vk: Rework the unique resource id system and apply it to buffer views
|
||||
* overlays: allow to update messages by id instead of text
|
||||
|
||||
- Update to 0.0.38~git20251015:
|
||||
* Qt: Allow to clear keyboard shortcuts in dialog
|
||||
* [Build] Explicit Triple with LLVM 21.1.0
|
||||
* SaveStates: Improve try_lock_spu_threads_in_a_state_compatible_with_savestates
|
||||
* ffmpeg: update cellAtracXDec to ffmpeg 7
|
||||
* Qt: Fix savestate failuire message
|
||||
* Debug: Apply SPU Profiling data if debug enabled
|
||||
* SaveStates: Fix Gem Thread Reboot
|
||||
* rsx: Fix user clip plane encode/decode
|
||||
* vk: Uniquely identify images using a monotonic incrementing counter
|
||||
* vk: Add support for blackwell PCI IDs
|
||||
* vk: Improve documentation and remove notifications from instancing buffer
|
||||
* vk: Raise heap changed interrupt when growing persistently bound SSBOs
|
||||
* vk: Restore thread safety locks to descriptor routines
|
||||
* vk: Fix shader interpreter compilation and crashes
|
||||
* gl: Reimplement user clip planes using the new ABI
|
||||
* vk: Fix user clip planes
|
||||
* vk: Don't use rebar for transform constants data
|
||||
* vk: Add re-bar toggle to GUI
|
||||
* vk: Use BAR memory pool for low-latency resource uploads
|
||||
* vk: Decorations for readonly SSBOs
|
||||
* vk/exp: Remove unnecessary locks and optimize VS
|
||||
* rsx/vk: Update shader interpreter to use new varying draw params model
|
||||
* vk: Pass draw parameters to FS via varying register
|
||||
* gl: Fix compilation error when using clip planes
|
||||
* vk: Fix shader compiler issues caused by broken preprocessor macro expansion
|
||||
* vk: Guard against concurrent access of storage pool under high pressure and MTRSX.
|
||||
* vk: Rewrite descriptor write template management
|
||||
* rsx: Fix shader interpreter compilation
|
||||
* vk: Fix shader compilation for certain glslang versions
|
||||
* rsx: Restore optimizations in fragment shader recompiler
|
||||
* vk: Improved state cache tracking
|
||||
* vk: Fix raster-env buffer type
|
||||
* vk: Fix shader compilation with fog parameters
|
||||
* vk: Move polygon stipple parameters to fixed array buffer
|
||||
* vk: Fix stale pointer reference when back-to-back partial updates are interrupted by a shader swap
|
||||
* vk: Fix windows build
|
||||
* vk: Fix wpos computation
|
||||
* vk: Implement state tracking for command buffers
|
||||
* vk: Combine all draw-time constants to a single struct and update only the offset id
|
||||
* vk: Implement descriptor write buffering
|
||||
* rsx: Prepend namespace for simple_array uses
|
||||
* rsx: Use simple array for texcoord stack
|
||||
* rsx: Simplify descriptor set contract a bit
|
||||
* vk: Move texture parameter stream to SSBO layout
|
||||
* vk: Move FS context vars to block format
|
||||
* rsx/common: Add reverse_ptr impl to VS tree
|
||||
* rsx: Fix bugs in fragment program constants stream maagement
|
||||
* vk: Fix vertex context indexing
|
||||
* vk: Fix fragment constants indexing
|
||||
* vk: Fix use of push constants
|
||||
* rsx: Fix bug in reverse_iterator for simple_array
|
||||
* rsx/vk: Convert fragment constants from static struct to array of vec4
|
||||
* rsx: Enhance unordered_map declaration to be more versatile
|
||||
* rsx: Replace use of small vectors with simple_array
|
||||
* vk: Move draw-time constants to vertex layout stream and make it SSBO
|
||||
* vk: Get basic vertex shaders working without traditional UBOs
|
||||
* vk: Fix allocation of vertex env data
|
||||
* vk: Start converting UBO bindings to SSBO indexed arrays
|
||||
|
||||
- Update to version 0.0.38~git20251010:
|
||||
* Qt: fix some warnings
|
||||
* cellL10n: fix ucs2 type
|
||||
* vm.cpp: remove unused variable
|
||||
* cellPad: Fix some warnings
|
||||
* Qt/Input: Adjust pad settings dialog based on pad capabilities
|
||||
* Update Qt to 6.10.0
|
||||
|
||||
- Update to version 0.0.38~git20251007:
|
||||
* rpcs3_version: Bump to 0.0.38
|
||||
* Multi-Slot Savestates
|
||||
* Fix sceNpManagerGetAccountRegion's returned language
|
||||
* Change sceNpManagerGetMyLanguages languages priority
|
||||
* Generate random OpenPSID upon config initialization (#17543)
|
||||
* sys_ss/RPCN: Add PSID randomisation
|
||||
* Update FAudio to 25.10
|
||||
* Config: Implement 128-bit setting entry type
|
||||
* Win32/vm_native.cpp: Improve sparse memory file mapping robustness
|
||||
* yorha: Style QScrollbar
|
||||
* yorha: Tag r4 theme update
|
||||
* yorha: Fix excessive QSpinBox height
|
||||
* yorha: Fix background on savestate manager
|
||||
* yorha: Unify QCheckBox and QList/QTree indicator styling
|
||||
* yorha: Fix left padding on QDockWidget titles
|
||||
* yorha: Only modify QMenuBar height on the main menu bar
|
||||
* Windows 11 Themes
|
||||
* cubeb: Update to 2025-09-17
|
||||
* Enhance Infinity Manager Figure Creator Dialog (#17529)
|
||||
* Fix calloc patches in the middle of blocks
|
||||
* cellPad: simplify output button logic
|
||||
|
||||
- BuildRequires: llvm19-devel (boo#1250352)
|
||||
* Fixes llvm 21 build error
|
||||
* Triple constructor is no longer implicit
|
||||
|
||||
- Update to version 0.0.37~git20250922:
|
||||
* PPU LLVM: Filter out functions with patches
|
||||
* Audio Processing Improvements (#17525)
|
||||
* sys_spu: Untangle IDM mutex from sys_spu's
|
||||
* SPU: Fix Max SPURS Threads Limit
|
||||
* SPU: Fix group wakeup
|
||||
* SDL: call SDL_PumpEvents from main thread
|
||||
* Fix rc variants of ADDE and SUBFE in interpreter
|
||||
* Win32/SPU: Respect home space / shadow space on the stack frame
|
||||
* Win32: Respect home space / shadow space on the stack frame (#17514)
|
||||
* Revert "Update wolfssl to 5.8.2"
|
||||
* Qt: Fix savestate table selection style
|
||||
* vk: Fix invalidated surface_cache resource deletion bug
|
||||
* Qt: Check if movie item changed and is valid before calling the
|
||||
callbacks
|
||||
* qt: use the same date format in all managers
|
||||
* rsx: allow to toggle 3D modes dynamically
|
||||
* rsx: fix 3D aspect ratio
|
||||
* cellMouse: Add debug overlay
|
||||
* Update curl to 8.16.0
|
||||
* input: restore original defaults when changing pad handlers
|
||||
* qt/input: add vibration threshold to pad settings dialog
|
||||
* input: Memorize original small motor value for display purposes
|
||||
* input: simplify VibrateMotor constructor
|
||||
* cellPad: Add DS3 motor speed threshold
|
||||
* System: expose date format and time format as settings
|
||||
* Add selection on firmware libraries panel by double-clicking (#17481)
|
||||
* input: fix sdl pad handler LED and rumble properties
|
||||
* Fix emulator crash when a pad gets disconnected (e.g. due to
|
||||
inactivity) (#17478)
|
||||
* Update opencv to 4.12.0
|
||||
* Network: Increase P2P listener thread rest duration (#17474)
|
||||
* SPU: Restore postponed LR notifications (with tweaks)
|
||||
* SPU: Limit SPU self notifying thread to 12+ threaded CPUs
|
||||
* SPU: Self-notifying SPU waiters
|
||||
* SPU: Reimplement reservation notifications
|
||||
* Update SDL to 3.2.22
|
||||
* Update FAudio to 25.09
|
||||
* Qt: fix saved gs_frame visibility
|
||||
* Minor improvements and cleanup on VFS panel (#17459)
|
||||
|
||||
- Update to version 0.0.37~git20250827:
|
||||
* Fix raw mouse handler keypress logic
|
||||
* asm.hpp: Make utils::rational_mul<u64>() consistent (#17452)
|
||||
* vfs_dialog: ensure that one item is always selected
|
||||
* vfs_dialog: allow to check list items with double-click
|
||||
* patch_manager: make patches selectable by double click
|
||||
* overlays: add settings for screenshot and recording hints
|
||||
* Audio: simplify apply_volume
|
||||
* SPU: Update RdEventStat Busy Wait detection to updated setting behavior
|
||||
|
||||
- Update to version 0.0.37~git20250817:
|
||||
* Fixes for AppImage not targeting Gamemode (#17398)
|
||||
* SPULLVMRecompiler: add overload for _ptr
|
||||
* SPULLVMRecompiler: remove unused parameters from spu_ptr and _ptr
|
||||
* llvm: use CreatePtrAdd
|
||||
* Update FAudio to 25.08
|
||||
* Remove alternative default device detection in Cubeb backend
|
||||
* Fix description of system wolfSSL option
|
||||
* Add option to use system Vulkan Memory Allocator
|
||||
* Add option to use system hidapi
|
||||
* Add option to use system zstd
|
||||
* Add option to use system glslang
|
||||
* Add option to use system RtMidi
|
||||
* Add option to use system MiniUPnPc
|
||||
* Set USE_SYSTEM_OPENAL default to OFF on macOS and Windows
|
||||
* Fix USE_SYSTEM_OPENAL to use system headers
|
||||
* Update wolfssl to 5.8.2
|
||||
</description>
|
||||
<package>rpcs3</package>
|
||||
<seperate_build_arch/>
|
||||
</patchinfo>
|
||||
@@ -1,18 +0,0 @@
|
||||
<patchinfo incident="packagehub-50">
|
||||
<issue tracker="bnc" id="1254437">VUL-0: CVE-2025-64460,CVE-2025-13372: python-Django: Algorithmic complexity in `django.core.serializers.xml_serializer.getInnerText()` allows a remote attacker to cause a potential denial-of-service attack triggering CPU and memory exhaustion</issue>
|
||||
<issue tracker="bnc" id="1252926">VUL-0: CVE-2025-64459: python-Django,python-Django4: Potential SQL injection via `_connector` keyword argument in `QuerySet` and `Q` objects</issue>
|
||||
<issue tracker="cve" id="2025-13372">cve#2025-13372 not resolved: 404 Client Error: Not Found for url: https://bugzilla.suse.com/api2/issues/?references__name=CVE-2025-13372</issue>
|
||||
<issue tracker="cve" id="2025-64460">cve#2025-64460 not resolved: 404 Client Error: Not Found for url: https://bugzilla.suse.com/api2/issues/?references__name=CVE-2025-64460</issue>
|
||||
<issue tracker="cve" id="2025-64459">cve#2025-64459 not resolved: 404 Client Error: Not Found for url: https://bugzilla.suse.com/api2/issues/?references__name=CVE-2025-64459</issue>
|
||||
<packager>mcalabkova</packager>
|
||||
<rating>important</rating>
|
||||
<category>security</category>
|
||||
<summary>Security update for python-Django</summary>
|
||||
<description>This update for python-Django fixes the following issues:
|
||||
|
||||
- CVE-2025-64459: Fixed a potential SQL injection via `_connector` keyword argument in `QuerySet` and `Q` objects (bsc#1252926)
|
||||
- CVE-2025-13372,CVE-2025-64460: Fixed Denial of Service in 'django.core.serializers.xml_serializer.getInnerText()' (bsc#1254437)
|
||||
</description>
|
||||
<package>python-Django</package>
|
||||
<seperate_build_arch/>
|
||||
</patchinfo>
|
||||
@@ -1,13 +0,0 @@
|
||||
<patchinfo incident="packagehub-52">
|
||||
<issue tracker="cve" id="2025-53881">cve#2025-53881 not resolved: 404 Client Error: Not Found for url: https://bugzilla.suse.com/api2/issues/?references__name=CVE-2025-53881</issue>
|
||||
<issue tracker="bnc" id="1246457">VUL-0: CVE-2025-53881: exim: SUSE-specific logrotate configuration allows escalation from mail user/group to root</issue>
|
||||
<packager>bigironman</packager>
|
||||
<rating>moderate</rating>
|
||||
<category>security</category>
|
||||
<summary>Security update for exim</summary>
|
||||
<description>This update for exim fixes the following issues:
|
||||
|
||||
- CVE-2025-53881: Fixed a potential security issue with logfile rotation (bsc#1246457)
|
||||
</description>
|
||||
<package>exim</package>
|
||||
</patchinfo>
|
||||
@@ -1,18 +0,0 @@
|
||||
<patchinfo incident="packagehub-53">
|
||||
<packager>michals</packager>
|
||||
<rating>moderate</rating>
|
||||
<category>recommended</category>
|
||||
<summary>Recommended update for virtme</summary>
|
||||
<description>This update for virtme fixes the following issues:
|
||||
|
||||
- Update to 1.40:
|
||||
* No significant change, this is just a very small hotfix release
|
||||
to solve a packaging problem introduced by a conflict with the
|
||||
new vng-mcp tool.
|
||||
* While at it, there're also some small improved hints in the MCP
|
||||
server, so that AI agents can better understand how to build
|
||||
the kernel using vng --build.
|
||||
</description>
|
||||
<package>virtme</package>
|
||||
<seperate_build_arch/>
|
||||
</patchinfo>
|
||||
@@ -1,20 +0,0 @@
|
||||
<patchinfo incident="packagehub-57">
|
||||
<issue tracker="bnc" id="1254531">cmake-extras: Could not locate qmlplugindump</issue>
|
||||
<issue tracker="bnc" id="1239788">cmake4: build failure tracker bug.</issue>
|
||||
<packager>hillwood</packager>
|
||||
<rating>moderate</rating>
|
||||
<category>recommended</category>
|
||||
<summary>Recommended update for cmake-extras</summary>
|
||||
<description>This update for cmake-extras fixes the following issues:
|
||||
|
||||
- Support both qmlplugindump-qt5 and qmlplugindump-qt6 (boo#1254531)
|
||||
- Fix filename and path of qmlplugindump-qt5 for openSUSE
|
||||
- Update to 1.9
|
||||
* add support for CMake 4.0
|
||||
- Update to 1.8
|
||||
* GMock: wire dependencies between GMock step and library files
|
||||
* QmlPlugins: Crude support for qt6
|
||||
</description>
|
||||
<package>cmake-extras</package>
|
||||
<seperate_build_arch/>
|
||||
</patchinfo>
|
||||
@@ -1,11 +0,0 @@
|
||||
<patchinfo incident="packagehub-58">
|
||||
<packager>pgajdos</packager>
|
||||
<rating>moderate</rating>
|
||||
<category>optional</category>
|
||||
<summary>Optional update for rawtherapee</summary>
|
||||
<description>This update for rawtherapee fixes the following issues:
|
||||
|
||||
Ship rawtherapee image editor.
|
||||
</description>
|
||||
<package>rawtherapee</package>
|
||||
</patchinfo>
|
||||
@@ -1,17 +0,0 @@
|
||||
<patchinfo incident="packagehub-55">
|
||||
<issue tracker="cve" id="2025-14372">cve#2025-14372 not resolved: 404 Client Error: Not Found for url: https://bugzilla.suse.com/api2/issues/?references__name=CVE-2025-14372</issue>
|
||||
<issue tracker="bnc" id="1254776">VUL-0: chromium: release 143.0.7499.109</issue>
|
||||
<issue tracker="cve" id="2025-14373">cve#2025-14373 not resolved: 404 Client Error: Not Found for url: https://bugzilla.suse.com/api2/issues/?references__name=CVE-2025-14373</issue>
|
||||
<packager>AndreasStieger</packager>
|
||||
<rating>important</rating>
|
||||
<category>security</category>
|
||||
<summary>Security update for chromium</summary>
|
||||
<description>This update for chromium fixes the following issues:
|
||||
|
||||
- Chromium 143.0.7499.109 (boo#1254776):
|
||||
* CVE-2025-14372: Use after free in Password Manager
|
||||
* CVE-2025-14373: Inappropriate implementation in Toolbar
|
||||
* third issue with an exploit is known to exist in the wild
|
||||
</description>
|
||||
<package>chromium</package>
|
||||
</patchinfo>
|
||||
@@ -1,15 +0,0 @@
|
||||
<patchinfo incident="packagehub-56">
|
||||
<issue tracker="bnc" id="1254386">labwc crashes when turning display off with wlr-randr (fixed in upstream and Factory)</issue>
|
||||
<packager>lucsansag</packager>
|
||||
<rating>moderate</rating>
|
||||
<category>recommended</category>
|
||||
<summary>Recommended update for labwc</summary>
|
||||
<description>This update for labwc fixes the following issues:
|
||||
|
||||
Changes in labwc:
|
||||
|
||||
- Fixed layershell unmap segfault when no outputs left (boo#1254386)
|
||||
</description>
|
||||
<package>labwc</package>
|
||||
<seperate_build_arch/>
|
||||
</patchinfo>
|
||||
Submodule perl-Mojolicious-Plugin-Webpack updated: e705781dcf...adda8796e4
Submodule python-Django updated: 58adc28d1a...a2220d5d79
Submodule rawtherapee deleted from 67ee9041f2
2
rpcs3
2
rpcs3
Submodule rpcs3 updated: 5540531e90...1c7788eec1
2
trivy
2
trivy
Submodule trivy updated: cdbf0f01cd...17acbb0d97
2
virtme
2
virtme
Submodule virtme updated: 85fe0b3c34...b4dd61c394
@@ -65,7 +65,6 @@
|
||||
"mschnitzer",
|
||||
"msmeissn",
|
||||
"openqa-maintenance",
|
||||
"rfrohl",
|
||||
"foursixnine-openqa",
|
||||
"szarate"
|
||||
],
|
||||
|
||||
Reference in New Issue
Block a user