Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package libsoup for openSUSE:Factory checked in at 2026-10-30 18:09:33 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/libsoup (Old) and /work/SRC/openSUSE:Factory/.libsoup.new.1255 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "libsoup" Fri Oct 30 18:09:33 2026 rev:174 rq:1393563 version:3.8.1 Changes: -------- --- /work/SRC/openSUSE:Factory/libsoup/libsoup.changes 2026-09-19 22:19:47.584231987 +0200 +++ /work/SRC/openSUSE:Factory/.libsoup.new.1255/libsoup.changes 2026-10-30 18:13:17.873772988 +0100 @@ -1,0 +2,170 @@ +Sun Oct 25 17:24:14 UTC 2026 - Bjørn Lie <[email protected]> + +- Update to version 3.8.1: + * Limit the size of intermediate (redirect and auth) response bodies + * Http2: Fix stalls when the reader is slower than the session timeout, and + propagate connection errors to response body streams + * Zstd: Support multiple concatenated frames, which previously truncated + responses + * Cookie-jar: Fix a `SoupConnection` leak when using an HTTP proxy + * Logger: Fix undefined behavior found by UBSan + * Build: Require brotli >= 1.1.0 for brotli support + * Fix building the tests on Windows and update README.msvc + * Updated translations. +- Add explicit pkgconfig(libbrotlienc) BuildRequires: meson setup checks for it + +------------------------------------------------------------------- +Thu Oct 1 06:50:59 UTC 2026 - Dominique Leuenberger <[email protected]> + +- Update to version 3.8.0: + + Harden authentication: + - Check `nonce` validity in Digest authentication + (CVE-2026-3099) + - Do not send cached proxy credentials after a redirect to a + different origin + + Harden multipart handling: + - Fix an out-of-bounds read when less data than the boundary is + buffered (CVE-2026-66337) + - Limit the length of part headers + - Fix a leak of the current part's headers + + Prevent request smuggling in the server: + - Close the connection after an early response to `Expect: + 100-continue` + - Reject `Host` headers containing URI delimiters + - Require chunk-size to begin with a hex digit + + Http2: + - Fix skipping over multiple buffered chunks of a response body + - Fix a `GCancellable` leak [Michael Catanzaro] + + Fix the build on platforms without `dlfcn.h` + + Updated translations. + +------------------------------------------------------------------- +Wed Sep 30 21:37:42 CEST 2026 - Dominique Leuenberger <[email protected]> + +- Skip test-suite on non-64-bit architectures + (glgo#GNOME/libsoup#556). + +------------------------------------------------------------------- +Wed Sep 30 21:37:41 CEST 2026 - Bjørn Lie <[email protected]> + +- Update to version 3.7.3: + + Add `soup_message_set_compression_dictionary_id()` and + `soup_message_get_compression_dictionary_id()` to send the + `Dictionary-ID` header alongside `Available-Dictionary` + + Add `soup_websocket_extension_process_incoming_message_with_limit()` + so extensions can bound how much they decompress + + Harden WebSocket handling: + - Bound decompressed message size during inflation + (CVE-2026-15709) + - Reject oversized control frames (CVE-2026-15711) + - Cap incoming frame payloads, message reassembly, and outgoing + frames at what the underlying buffer can hold + - Bound outgoing permessage-deflate buffer growth + - Cap the number of queued unsolicited pongs + - Emit `SoupWebsocketConnection::pong` with a `GBytes`, as + declared + - Store accepted WebSocket extensions per message rather than + per handler + + Harden authentication and caching: + - Do not send `Proxy-Authorization` through an established + CONNECT tunnel (CVE-2026-66339) + - Scope cached proxy credentials to the proxy they came from + (CVE-2026-12547) + - Reject caching authenticated responses in shared caches + (CVE-2026-15713) + + Tighten HTTP parsing and validation: + - Reject CRLF injection in the HTTP method (CVE-2026-3633) + - Fix `Range` parsing overflows and coalescing cost, and + validate `Content-Range` when parsing it + - Keep duplicate `Content-Length` headers when they are + identical + - Fix an out-of-bounds read in case of an excessively long + multipart boundary + - Do not treat base64 data URI content as a NUL-terminated + string + + http2: + - Never send more body bytes than nghttp2 requested + (CVE-2026-85534) + - Keep the message alive across `io_run_until()` in + `run_until_read()` + - Do not assume that `GOAWAY` opaque data is NUL-terminated + + server: Report the resource length in 416 responses + + session: Do not send a message cancelled while being queued + + cookie: Annotate constants' values +- Drop libsoup-CVE-2026-85534.patch, - Drop + libsoup-CVE-2026-15711.patch, libsoup-CVE-2026-12547.patch, + libsoup-CVE-2026-15712.patch, libsoup-CVE-2026-15714.patch, + libsoup-CVE-2026-66339.patch: fixed upstream. + +------------------------------------------------------------------- +Wed Sep 30 21:37:40 CEST 2026 - Bjørn Lie <[email protected]> + +- Update to version 3.7.2: + + Add support for compression dictionaries: + - Support the dcb and dcz encodings + - Add new `soup_message_set_compression_dictionary_hash()`, + `SoupMessage::request-compression-dictionary`, and + `SoupCompressionDictionaryRequest` + + Remove color codes from http2 debug logs + + Add missing autoptr defines for `SoupMessageBody` + + http2: + - Fix content-sniffer running while message is paused + - Consume buffered response body before cancel + - Fix requeuing failed messages when connection is not reusable + + soup-body-input-stream: Limit buffer read to the received + content + +------------------------------------------------------------------- +Wed Sep 30 21:37:39 CEST 2026 - Cliff Zhao <[email protected]> + +- Update to version 3.7.1: + Use canonical signal names. + message: Use G_PARAM_STATIC_STRINGS. + http2: Add missing G_BEING_DECLS. + soup-auth-ntlm: Reject excessively long passwords. + (CVE-2026-0719, bsc#1256399) + websocket: add a way to restrict the total message size. + (CVE-2025-32049, bsc#1240751) + Do not allow adding multiple content length values to headers. + (CVE-2026-2708, bsc#1258508) + Also remove Proxy-Authorization header on cross origin redirect. + (CVE-2026-1539, bsc#1257441) + websocket: Fix out-of-bounds read when reading unmasked frame. + (CVE-2026-0716, bsc#1256418) + server: protect message io while reading and writing. + (CVE-2026-4271, bsc#1259767) +- Drop merged fixes in 3.7.1: + libsoup-CVE-2025-32049.patch, libsoup-CVE-2026-12478.patch + libsoup-CVE-2026-0719.patch, libsoup-CVE-2026-1539.patch + libsoup-CVE-2026-2708.patch, libsoup-CVE-2026-4271.patch, + libsoup-CVE-2026-12548.patch, libsoup-CVE-2026-85197.patch +- Drop fix-samsung-tv-playback.patch: fixed upstream + +------------------------------------------------------------------- +Mon Sep 28 15:30:42 UTC 2026 - Michael Gorse <[email protected]> + +- CVE-2026-15711: WebSocket denial of service via oversized control + frame protocol violation (bsc#1271446) + * libsoup-CVE-2026-15711.patch +- CVE-2026-15712: HTTP/2 GOAWAY frame parsing heap buffer + over-read via invalid NUL-termination assumption (bsc#1271447) + * libsoup-CVE-2026-15712.patch +- CVE-2026-15714: Out-of-bounds read in + soup_multipart_input_stream_read_headers via an oversized + multipart boundary string (bsc#1271449) + * libsoup-CVE-2026-15714.patch +- CVE-2026-66339: proxy credentials leak to destination server via + `Proxy-Authorization` header in CONNECT tunnels (bsc#1273156) + * libsoup-CVE-2026-66339.patch +- CVE-2026-12547: Header "Proxy-Authorization" leads to credentials + being send to different proxy after proxy switch (bsc#1272195) + * libsoup-CVE-2026-12547.patch +- Drop SLE patches to revert the meson dependency. Meson is being + updated to version 0.63.3 in SLE-15-SP4, so, even if libsoup is + updated there, these patches would not be needed. + + libsoup-revert-dep-meson-0.62-part01-4209dbec.patch + + libsoup-revert-dep-meson-0.62-part02-fd7ce01a.patch + + libsoup-revert-dep-meson-0.62-shim01-e315cf2d.patch + + libsoup-revert-dep-meson-0.62-shim02-6b34bc58.patch + +------------------------------------------------------------------- @@ -4048,0 +4219 @@ + Old: ---- fix-samsung-tv-playback.patch libsoup-3.6.6.tar.xz libsoup-CVE-2025-32049.patch libsoup-CVE-2026-0719.patch libsoup-CVE-2026-12478.patch libsoup-CVE-2026-12548.patch libsoup-CVE-2026-1539.patch libsoup-CVE-2026-2708.patch libsoup-CVE-2026-4271.patch libsoup-CVE-2026-85197.patch libsoup-CVE-2026-85534.patch libsoup-revert-dep-meson-0.62-part01-4209dbec.patch libsoup-revert-dep-meson-0.62-part02-fd7ce01a.patch libsoup-revert-dep-meson-0.62-shim01-e315cf2d.patch libsoup-revert-dep-meson-0.62-shim02-6b34bc58.patch New: ---- libsoup-3.8.1.tar.xz ----------(Old B)---------- Old: libsoup-CVE-2026-12548.patch, libsoup-CVE-2026-85197.patch - Drop fix-samsung-tv-playback.patch: fixed upstream Old:- Drop merged fixes in 3.7.1: libsoup-CVE-2025-32049.patch, libsoup-CVE-2026-12478.patch libsoup-CVE-2026-0719.patch, libsoup-CVE-2026-1539.patch Old: libsoup-CVE-2025-32049.patch, libsoup-CVE-2026-12478.patch libsoup-CVE-2026-0719.patch, libsoup-CVE-2026-1539.patch libsoup-CVE-2026-2708.patch, libsoup-CVE-2026-4271.patch, Old:- Drop merged fixes in 3.7.1: libsoup-CVE-2025-32049.patch, libsoup-CVE-2026-12478.patch libsoup-CVE-2026-0719.patch, libsoup-CVE-2026-1539.patch Old: libsoup-CVE-2026-2708.patch, libsoup-CVE-2026-4271.patch, libsoup-CVE-2026-12548.patch, libsoup-CVE-2026-85197.patch - Drop fix-samsung-tv-playback.patch: fixed upstream Old: libsoup-CVE-2025-32049.patch, libsoup-CVE-2026-12478.patch libsoup-CVE-2026-0719.patch, libsoup-CVE-2026-1539.patch libsoup-CVE-2026-2708.patch, libsoup-CVE-2026-4271.patch, Old: libsoup-CVE-2026-0719.patch, libsoup-CVE-2026-1539.patch libsoup-CVE-2026-2708.patch, libsoup-CVE-2026-4271.patch, libsoup-CVE-2026-12548.patch, libsoup-CVE-2026-85197.patch Old: libsoup-CVE-2026-0719.patch, libsoup-CVE-2026-1539.patch libsoup-CVE-2026-2708.patch, libsoup-CVE-2026-4271.patch, libsoup-CVE-2026-12548.patch, libsoup-CVE-2026-85197.patch Old: libsoup-CVE-2026-2708.patch, libsoup-CVE-2026-4271.patch, libsoup-CVE-2026-12548.patch, libsoup-CVE-2026-85197.patch - Drop fix-samsung-tv-playback.patch: fixed upstream Old: + cookie: Annotate constants' values - Drop libsoup-CVE-2026-85534.patch, - Drop libsoup-CVE-2026-15711.patch, libsoup-CVE-2026-12547.patch, Old: updated there, these patches would not be needed. + libsoup-revert-dep-meson-0.62-part01-4209dbec.patch + libsoup-revert-dep-meson-0.62-part02-fd7ce01a.patch Old: + libsoup-revert-dep-meson-0.62-part01-4209dbec.patch + libsoup-revert-dep-meson-0.62-part02-fd7ce01a.patch + libsoup-revert-dep-meson-0.62-shim01-e315cf2d.patch Old: + libsoup-revert-dep-meson-0.62-part02-fd7ce01a.patch + libsoup-revert-dep-meson-0.62-shim01-e315cf2d.patch + libsoup-revert-dep-meson-0.62-shim02-6b34bc58.patch Old: + libsoup-revert-dep-meson-0.62-shim01-e315cf2d.patch + libsoup-revert-dep-meson-0.62-shim02-6b34bc58.patch ----------(Old E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ libsoup.spec ++++++ --- /var/tmp/diff_new_pack.wflNsm/_old 2026-10-30 18:13:21.222913190 +0100 +++ /var/tmp/diff_new_pack.wflNsm/_new 2026-10-30 18:13:21.228913441 +0100 @@ -16,9 +16,11 @@ # -%define api_version 3.0 +%global api_version 3.0 +%global gnome_version %(echo %{version} | sed -E 's/^([0-9]+\.[0-9]+).*/\1/') + Name: libsoup -Version: 3.6.6 +Version: 3.8.1 Release: 0 Summary: HTTP client/server library for GNOME License: LGPL-2.1-or-later @@ -26,36 +28,6 @@ URL: https://wiki.gnome.org/Projects/libsoup Source0: %{name}-%{version}.tar.xz Source99: baselibs.conf -# PATCH-FIX-UPSTREAM libsoup-CVE-2026-0719.patch bsc#1256399, CVE-2026-0719, glgo#GNOME/libsoup!493 [email protected] -- Fix overflow for password md4sum -Patch1: libsoup-CVE-2026-0719.patch -# PATCH-FIX-OPENSUSE libsoup-CVE-2025-32049.patch bsc#1240751 [email protected] -- add size limit for total message size. -Patch2: libsoup-CVE-2025-32049.patch -# PATCH-FIX-UPSTREAM libsoup-CVE-2026-2708.patch bsc#1258508 [email protected] -- do not allow adding multiple content length values to headers. -Patch3: libsoup-CVE-2026-2708.patch -# PATCH-FIX-UPSTREAM libsoup-CVE-2026-1539.patch bsc#1257441, CVE-2026-1539, glgo#GNOME/libsoup#489 -- Also remove Proxy-Authorization header on cross origin redirect -Patch4: libsoup-CVE-2026-1539.patch -# PATCH-FIX-UPSTREAM libsoup-CVE-2026-12478.patch bsc#1271401 [email protected] -- websocket: Fix out-of-bounds read when reading unmasked frame -Patch5: libsoup-CVE-2026-12478.patch -# PATCH-FIX-UPSTREAM libsoup-CVE-2026-4271.patch bsc#1259767 [email protected] -- protect message io while reading and writing -Patch6: libsoup-CVE-2026-4271.patch -# PATCH-FIX-UPSTREAM fix-samsung-tv-playback.patch -- Update the content length decimal value when encoding is set to SOUP_ENCODING_CONTENT_LENGTH -Patch7: fix-samsung-tv-playback.patch -# PATCH-FIX-UPSTREAM libsoup-CVE-2026-12548.patch bsc#1272196, glgo#GNOME/libsoup!524 [email protected] -- Fix heap out-of-bounds read flaw when parsing multipart HTTP messages -Patch8: libsoup-CVE-2026-12548.patch -# PATCH-FIX-UPSTREAM libsoup-CVE-2026-85534.patch bsc#1279239 [email protected] -- Never send more body bytes than nghttp2 requested -Patch9: libsoup-CVE-2026-85534.patch -# PATCH-FIX-UPSTREAM libsoup-CVE-2026-85197.patch bsc#1279238 [email protected] -- fix crash in on_data_read after connection has been destroyed -Patch10: libsoup-CVE-2026-85197.patch - -# PATCH-FIX-SLE libsoup-revert-dep-meson-0.62-shim01-e315cf2d.patch [email protected] -- Revert upstream e315cf2d to make libsoup build with meson 0.54 for SLE-15-SP4/SP5. -Patch1000: libsoup-revert-dep-meson-0.62-shim01-e315cf2d.patch -# PATCH-FIX-SLE libsoup-revert-dep-meson-0.62-shim02-6b34bc58.patch [email protected] -- Revert upstream 6b34bc58 to make libsoup build with meson 0.54 for SLE-15-SP4/SP5. -Patch1001: libsoup-revert-dep-meson-0.62-shim02-6b34bc58.patch -# PATCH-FIX-SLE libsoup-revert-dep-meson-0.62-part01-4209dbec.patch [email protected] -- Revert upstream 4209dbec to make libsoup build with meson 0.54 for SLE-15-SP4/SP5. -Patch1002: libsoup-revert-dep-meson-0.62-part01-4209dbec.patch -# PATCH-FIX-SLE libsoup-revert-dep-meson-0.62-part02-fd7ce01a.patch [email protected] -- Revert upstream fd7ce01a to make libsoup build with meson 0.54 for SLE-15-SP4/SP5. -Patch1003: libsoup-revert-dep-meson-0.62-part02-fd7ce01a.patch - BuildRequires: glib-networking BuildRequires: meson >= 0.53 BuildRequires: pkgconfig @@ -66,11 +38,13 @@ BuildRequires: pkgconfig(gobject-2.0) >= 2.69.1 BuildRequires: pkgconfig(gobject-introspection-1.0) >= 0.9.5 BuildRequires: pkgconfig(krb5-gssapi) -BuildRequires: pkgconfig(libbrotlidec) +BuildRequires: pkgconfig(libbrotlidec) >= 1.1.0 +BuildRequires: pkgconfig(libbrotlienc) >= 1.1.0 BuildRequires: pkgconfig(libnghttp2) BuildRequires: pkgconfig(libpsl) >= 0.20 BuildRequires: pkgconfig(sqlite3) BuildRequires: pkgconfig(vapigen) +BuildRequires: pkgconfig(libzstd) # We do not need these dependencies needed only for tests. #BuildRequires: apache2-mod_php5 php5-xmlrpc @@ -155,11 +129,7 @@ %lang_package %prep -%autosetup -N -%autopatch -p1 -M 999 -%if 0%{?sle_version} >= 150400 && 0%{?sle_version} <= 155000 -%autopatch -p1 -m 1000 -%endif +%autosetup -p1 %build %meson \ @@ -181,6 +151,7 @@ # Move docs from upstream docdir to openSUSE docdir standard mv %{buildroot}%{_datadir}/doc/%{name}-%{api_version} %{buildroot}%{_docdir} +%if %__isa_bits == 64 %check # Run the regression tests using GnuTLS NORMAL priority export G_TLS_GNUTLS_PRIORITY=NORMAL @@ -189,6 +160,7 @@ %else %meson_test %endif +%endif %ldconfig_scriptlets 3_0-0 ++++++ _scmsync.obsinfo ++++++ --- /var/tmp/diff_new_pack.wflNsm/_old 2026-10-30 18:13:21.299916413 +0100 +++ /var/tmp/diff_new_pack.wflNsm/_new 2026-10-30 18:13:21.308916790 +0100 @@ -1,7 +1,7 @@ -mtime: 1789610422 -commit: eb757a42f477245cce235b44e81490497db259eaf8fee3285f161c5eab0ee74c +mtime: 1792970033 +commit: 77977a60b357029bfc3d0daae2fe9ee5c24ea9852708edb7d63650a76e2adf4c url: https://src.opensuse.org/GNOME/libsoup -revision: eb757a42f477245cce235b44e81490497db259eaf8fee3285f161c5eab0ee74c +revision: 77977a60b357029bfc3d0daae2fe9ee5c24ea9852708edb7d63650a76e2adf4c trackingbranch: factory projectscmsync: https://src.opensuse.org/GNOME/_ObsPrj ++++++ _service ++++++ --- /var/tmp/diff_new_pack.wflNsm/_old 2026-10-30 18:13:21.357918841 +0100 +++ /var/tmp/diff_new_pack.wflNsm/_new 2026-10-30 18:13:21.366919218 +0100 @@ -3,7 +3,7 @@ <service name="obs_scm" mode="manual"> <param name="scm">git</param> <param name="url">https://gitlab.gnome.org/GNOME/libsoup.git</param> - <param name="revision">3.6.6</param> + <param name="revision">3.8.1</param> <param name="versionformat">@PARENT_TAG@+@TAG_OFFSET@</param> <param name="versionrewrite-pattern">v?(.*)\+0</param> <param name="versionrewrite-replacement">\1</param> ++++++ build.specials.obscpio ++++++ ++++++ build.specials.obscpio ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/.gitignore new/.gitignore --- old/.gitignore 1970-01-01 01:00:00.000000000 +0100 +++ new/.gitignore 2026-10-26 00:13:53.000000000 +0100 @@ -0,0 +1,5 @@ +*.obscpio +*.osc +_build.* +.pbuild +osc-collab.* ++++++ libsoup-3.6.6.tar.xz -> libsoup-3.8.1.tar.xz ++++++ ++++ 17880 lines of diff (skipped) ++++++ libsoup.obsinfo ++++++ --- /var/tmp/diff_new_pack.wflNsm/_old 2026-10-30 18:13:22.480965854 +0100 +++ /var/tmp/diff_new_pack.wflNsm/_new 2026-10-30 18:13:22.493966398 +0100 @@ -1,5 +1,5 @@ name: libsoup -version: 3.6.6 -mtime: 1771107212 -commit: 25eac153004f777581ca2d95e31a02ca96844332 +version: 3.8.1 +mtime: 1792948287 +commit: 2756d0076654b680d2021a08b9f2bd9d36d7ae1b
