Script 'mail_helper' called by obssrc
Hello community,
here is the log from the commit of package golang-github-prometheus-prometheus
for openSUSE:Factory checked in at 2026-10-27 16:47:23
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/golang-github-prometheus-prometheus (Old)
and
/work/SRC/openSUSE:Factory/.golang-github-prometheus-prometheus.new.2252680
(New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "golang-github-prometheus-prometheus"
Tue Oct 27 16:47:23 2026 rev:77 rq:1392998 version:3.15.0
Changes:
--------
---
/work/SRC/openSUSE:Factory/golang-github-prometheus-prometheus/golang-github-prometheus-prometheus.changes
2026-09-29 17:48:32.989135305 +0200
+++
/work/SRC/openSUSE:Factory/.golang-github-prometheus-prometheus.new.2252680/golang-github-prometheus-prometheus.changes
2026-10-27 16:47:56.966939110 +0100
@@ -1,0 +2,15 @@
+Mon Oct 26 22:46:04 UTC 2026 - Dirk Müller <[email protected]>
+
+- actually apply the patches
+
+-------------------------------------------------------------------
+Mon Oct 19 14:24:58 UTC 2026 - Witek Bedyk <[email protected]>
+
+- CVE-2026-93753: Bump sanitize-html to version 2.18.1 to remove
+ dependency on the vulnerable deepmerge library
+ (bsc#1282590)
+- Add 0003-Fix-CVE-2026-93753.patch
+- Remove 0003-Remove-build-react-app.patch
+- Clean up prepare_webassets.sh
+
+-------------------------------------------------------------------
Old:
----
0003-Remove-build-react-app.patch
New:
----
0003-Fix-CVE-2026-93753.patch
----------(Old B)----------
Old:- Add 0003-Fix-CVE-2026-93753.patch
- Remove 0003-Remove-build-react-app.patch
- Clean up prepare_webassets.sh
----------(Old E)----------
----------(New B)----------
New: (bsc#1282590)
- Add 0003-Fix-CVE-2026-93753.patch
- Remove 0003-Remove-build-react-app.patch
----------(New E)----------
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ golang-github-prometheus-prometheus.spec ++++++
--- /var/tmp/diff_new_pack.O6jSKK/_old 2026-10-27 16:48:00.887103508 +0100
+++ /var/tmp/diff_new_pack.O6jSKK/_new 2026-10-27 16:48:00.889103592 +0100
@@ -50,8 +50,7 @@
Patch1: 0001-Do-not-force-the-pure-Go-name-resolver.patch
# Lifted from Debian's prometheus package
Patch2: 0002-Default-settings.patch
-Patch3: 0003-Remove-build-react-app.patch
-#
+Patch3: 0003-Fix-CVE-2026-93753.patch
BuildRequires: fdupes
%if 0%{?suse_version} == 1500 && 0%{?sle_version} < 150300
BuildRequires: firewall-macros
@@ -87,12 +86,7 @@
- multiple modes of graphing and dashboarding support
%prep
-# As the 0003-Remove-build-react-app.patch patch was already applied
-# during the webassets generation, it would fail to apply now.
-# Hence we are using setup and autopatch instead of autosetup
-# to omit this patch during the build
-%setup -q -a1 -n prometheus-%{version}
-%autopatch -p1 -M 2
+%autosetup -p1 -a1 -n prometheus-%{version}
tar xf %{SOURCE2}
%build
@@ -178,8 +172,8 @@
Requires: firewalld
%description -n firewalld-prometheus-config
-This package contains configuration file for Prometheus for older versions of
-Firewalld which do not provide this in own package.
+This package contains a configuration file for Prometheus for older versions of
+Firewalld which do not provide this in their own package.
%files -n firewalld-prometheus-config
%dir %{_prefix}/lib/firewalld
++++++ 0003-Fix-CVE-2026-93753.patch ++++++
>From 702ccd1e5b17f74f49eb20eaf4eb5b65e240b904 Mon Sep 17 00:00:00 2001
From: Witek Bedyk <[email protected]>
Date: Mon, 19 Oct 2026 17:54:19 +0200
Subject: [PATCH] Bump sanitize-html to version 2.18.1
diff --git a/web/ui/mantine-ui/package.json b/web/ui/mantine-ui/package.json
index e8c1f5460..84e655f35 100644
--- a/web/ui/mantine-ui/package.json
+++ b/web/ui/mantine-ui/package.json
@@ -48,7 +48,7 @@
"react-infinite-scroll-component": "^6.1.1",
"react-redux": "^9.3.0",
"react-router-dom": "^7.18.1",
- "sanitize-html": "^2.17.6",
+ "sanitize-html": "^2.18.1",
"uplot": "^1.6.32",
"use-query-params": "^2.2.2"
},
diff --git a/web/ui/pnpm-lock.yaml b/web/ui/pnpm-lock.yaml
index a942a530d..0d8d176be 100644
--- a/web/ui/pnpm-lock.yaml
+++ b/web/ui/pnpm-lock.yaml
@@ -147,8 +147,8 @@ importers:
specifier: ^7.18.1
version: 7.18.3([email protected]([email protected]))([email protected])
sanitize-html:
- specifier: ^2.17.6
- version: 2.17.7
+ specifier: ^2.18.1
+ version: 2.18.1
uplot:
specifier: ^1.6.32
version: 1.6.32
@@ -2403,8 +2403,8 @@ packages:
[email protected]:
resolution: {integrity:
sha512-Vg4o6/fqPxIjtxgUH5QLJhwZ7gW5diGCVlXpuUfELC62CuxM1iHcRe51f2W1FDy04Ai4KJkagKjx3XaqyfRKXw==}
- [email protected]:
- resolution: {integrity:
sha512-VRSzKkbMm5jMDoKLbltAkFQ5Qr7VDiTFGXxYFXXowVj387GeGNOCsOH6Msy00SGZ3Fp84b1Naa1psqgcCIEP5Q==}
+ [email protected]:
+ resolution: {integrity:
sha512-bUi/yjmtKYcRVUtWRGr0UA6xEFh2I6zWUwMrUXB3s7bmYCaZ8a+0ZsTRkrawh/mzlSD1Y0Ph8bp/U+TvBpWDNw==}
engines: {node: '>=0.10.0'}
[email protected]:
@@ -2607,8 +2607,8 @@ packages:
[email protected]:
resolution: {integrity:
sha512-CYDD3SOtsHtyXeEORYRx2qBtpDJFjRTGXUtmNEMGyzYOKj1TE3tycdlho7kA1Ufx9OYWZzg52QFBGALTirzDSw==}
- [email protected]:
- resolution: {integrity:
sha512-mU6WRz5EusL9ZZuiZ5SO4Y6C0P9PAUR9iwdb6bzj4KDihm28DiHFw+/yk9DBH4f+Pv1wuzQ4e2jV3oQ7mkIqvw==}
+ [email protected]:
+ resolution: {integrity:
sha512-DLg3HPnHUfBi5/MxMLmJD12dmlMpFEC2HgMW6vkZ/9JR0RU00kXoRGvDxAvFmdO0o610OA77i4FgNTLucmhDVg==}
[email protected]:
resolution: {integrity:
sha512-qsda+H8jTaUaN/x5vzW2rzc+8Rw4TAQ/4KjB46IwK5VH+IlVeeeje/EoZRpiXvIqjFgK84QffqPztGI3VBLG1A==}
@@ -3152,8 +3152,8 @@ packages:
engines: {node: '>=18.0.0', npm: '>=8.0.0'}
hasBin: true
- [email protected]:
- resolution: {integrity:
sha512-PGtEkc9cbnedU3s9TmzDbpsZ8w086g/0Q8k8/oIO1NLNU3i5k9yn835CrjJSajp1KMmkisbO1qPXxNKO3welAg==}
+ [email protected]:
+ resolution: {integrity:
sha512-2X5lC8fYla8YaT8g73Nj+HcLWXan5dLyCWLgVvaOmfw7JI78IRsyNtIDytTHdn7hBQbIkCah7Zbmd5jabzeDig==}
engines: {node: '>=22.12.0'}
[email protected]:
@@ -5689,7 +5689,7 @@ snapshots:
[email protected]: {}
- [email protected]: {}
+ [email protected]: {}
[email protected]: {}
@@ -6101,7 +6101,7 @@ snapshots:
dependencies:
'@keyv/serialize': 1.1.1
- [email protected]:
+ [email protected]:
dependencies:
dayjs: 1.11.23
@@ -6606,13 +6606,12 @@ snapshots:
'@rollup/rollup-win32-x64-msvc': 4.63.1
fsevents: 2.3.3
- [email protected]:
+ [email protected]:
dependencies:
- deepmerge: 4.3.1
escape-string-regexp: 4.0.0
htmlparser2: 12.0.0
- is-plain-object: 5.0.0
- launder: 1.7.1
+ is-plain-object: 5.1.0
+ launder: 1.7.2
parse-srcset: 1.0.2
postcss: 8.5.28
--
2.51.0
++++++ prepare_webassets.sh ++++++
--- /var/tmp/diff_new_pack.O6jSKK/_old 2026-10-27 16:48:01.143114244 +0100
+++ /var/tmp/diff_new_pack.O6jSKK/_new 2026-10-27 16:48:01.154114705 +0100
@@ -42,18 +42,12 @@
cpio -id < "${working_directory}/${obscpio}" || exit 21
cd "${basename}" || exit 23
-patch -p1 < 0003-Remove-build-react-app.patch
-
echo "##########"
+patch -p1 -i "${working_directory}/0003-Fix-CVE-2026-93753.patch"
cd web/ui/ || exit 25
rm -rf node_modules || exit 27
pnpm install --frozen-lockfile
-# cd react-app || exit 25
-# rm -rf node_modules || exit 27
-# pnpm install --frozen-lockfile
-# cd .. || exit 25
-
CI="true" pnpm run build:mantine-ui
cd ../../ || exit 29
++++++ web-3.15.0.tar.gz ++++++
/work/SRC/openSUSE:Factory/golang-github-prometheus-prometheus/web-3.15.0.tar.gz
/work/SRC/openSUSE:Factory/.golang-github-prometheus-prometheus.new.2252680/web-3.15.0.tar.gz
differ: char 29, line 1
