Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package borgbackup for openSUSE:Factory checked in at 2026-11-02 16:40:33 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/borgbackup (Old) and /work/SRC/openSUSE:Factory/.borgbackup.new.1255 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "borgbackup" Mon Nov 2 16:40:33 2026 rev:58 rq:1394448 version:1.4.5 Changes: -------- --- /work/SRC/openSUSE:Factory/borgbackup/borgbackup.changes 2026-10-06 19:19:13.479573421 +0200 +++ /work/SRC/openSUSE:Factory/.borgbackup.new.1255/borgbackup.changes 2026-11-02 16:41:22.181753959 +0100 @@ -1,0 +2,11 @@ +Sun Nov 1 10:57:16 UTC 2026 - Bjørn Lie <[email protected]> + +- Add support-msgpack-1_2_4.patch (boo#1284139): Support ver 1.2.4 + msgpack 1.2.4 limits container preallocation in the C unpacker to + 10000 items, so a large declared array/map length can no longer + force an excessive memory allocation (GHSA-j8c6-9vc5-hj6x). + max_array_len and max_map_len still limit the total container + size. +- Drop support-msgpack-1_2_3.patch: No longer needed. + +------------------------------------------------------------------- @@ -4 +15 @@ -- Add support-msgpack-1_2_3.patch: Support msgpack 1.2.3. msgpack +- Add support-msgpack-1_2_3.patch (boo#1284139): Support ver 1.2.3 Old: ---- support-msgpack-1_2_3.patch New: ---- support-msgpack-1_2_4.patch ----------(Old B)---------- Old: size. - Drop support-msgpack-1_2_3.patch: No longer needed. ----------(Old E)---------- ----------(New B)---------- New: - Add support-msgpack-1_2_4.patch (boo#1284139): Support ver 1.2.4 msgpack 1.2.4 limits container preallocation in the C unpacker to ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ borgbackup.spec ++++++ --- /var/tmp/diff_new_pack.gnWJWt/_old 2026-11-02 16:41:23.040789919 +0100 +++ /var/tmp/diff_new_pack.gnWJWt/_new 2026-11-02 16:41:23.042790002 +0100 @@ -66,8 +66,8 @@ # python3-guzzle_sphinx_theme isn't available everywhere, # fall back to Sphinx default theme for older distributions Patch0: borgbackup-1.1.4-sphinx-default-theme.patch -# PATCH-FIX-UPSTREAM support-msgpack-1_2_3.patch -- support msgpack 1.2.3 -Patch1: support-msgpack-1_2_3.patch +# PATCH-FIX-UPSTREAM support-msgpack-1_2_4.patch -- support msgpack 1.2.4 +Patch1: support-msgpack-1_2_4.patch # SECTION build dependencies BuildRequires: bash BuildRequires: %{py3pkg}-Cython >= 3.0.10 @@ -98,9 +98,9 @@ # msgpack is not included with borg version >= 1.2.0 anymore # The metadata is very specific about the version, the command will fail if msgpack is out of range -- boo#1198267 # See https://github.com/borgbackup/borg/blob/1.4-maint/pyproject.toml#L39 and update this for every version bump! -BuildRequires: (%{py3pkg}-msgpack >= 1.0.3 with %{py3pkg}-msgpack <= 1.2.3) +BuildRequires: (%{py3pkg}-msgpack >= 1.0.3 with %{py3pkg}-msgpack <= 1.2.4) Requires: %{py3pkg}-packaging -Requires: (%{py3pkg}-msgpack >= 1.0.3 with %{py3pkg}-msgpack <= 1.2.3) +Requires: (%{py3pkg}-msgpack >= 1.0.3 with %{py3pkg}-msgpack <= 1.2.4) %if 0%{?suse_version} > 1500 # upstream recommends a "Requires" if pyfuse3 is available Requires: %{py3pkg}-pyfuse3 >= 3.1.1 ++++++ support-msgpack-1_2_3.patch -> support-msgpack-1_2_4.patch ++++++ --- /work/SRC/openSUSE:Factory/borgbackup/support-msgpack-1_2_3.patch 2026-10-06 19:19:13.501574344 +0200 +++ /work/SRC/openSUSE:Factory/.borgbackup.new.1255/support-msgpack-1_2_4.patch 2026-11-02 16:41:22.264757437 +0100 @@ -1,48 +1,31 @@ -From 084f3fbce66c29334ad0a1d83324011398339547 Mon Sep 17 00:00:00 2001 -From: Thomas Waldmann <[email protected]> -Date: Tue, 29 Sep 2026 20:03:48 +0200 -Subject: [PATCH] support msgpack 1.2.3 - -msgpack 1.2.3 brings fixes relevant to borg's usage of the C extension: -memory leaks when map key validation or container hooks fail -(GHSA-j586-36cw-2gc2) and a use-after-free when cleaning up an -incomplete Unpacker.skip(). - -The C Unpacker now raises ValueError when switching between unpack, -skip, header readers or read_bytes() while an object is incomplete. -borg only uses feed() plus unpack()/iteration (and RobustUnpacker -creates a fresh Unpacker on each resync attempt), so this does not -affect borg. - -Co-Authored-By: Claude Opus 5.5 <[email protected]> --- pyproject.toml | 2 +- src/borg/helpers/msgpack.py | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) -diff --git a/pyproject.toml b/pyproject.toml -index 14751c461d..c5b37836ef 100644 ---- a/pyproject.toml -+++ b/pyproject.toml -@@ -36,7 +36,7 @@ dependencies = [ +Index: borgbackup-1.4.5/pyproject.toml +=================================================================== +--- borgbackup-1.4.5.orig/pyproject.toml ++++ borgbackup-1.4.5/pyproject.toml +@@ -35,7 +35,7 @@ dependencies = [ # Please note: # Using any other msgpack version is not supported by Borg development and # any feedback related to issues caused by this will be ignored. - "msgpack >=1.0.3, <=1.2.1", -+ "msgpack >=1.0.3, <=1.2.3", ++ "msgpack >=1.0.3, <=1.2.4", "packaging", ] -diff --git a/src/borg/helpers/msgpack.py b/src/borg/helpers/msgpack.py -index 9d3405a307..1bbcdd2312 100644 ---- a/src/borg/helpers/msgpack.py -+++ b/src/borg/helpers/msgpack.py +Index: borgbackup-1.4.5/src/borg/helpers/msgpack.py +=================================================================== +--- borgbackup-1.4.5.orig/src/borg/helpers/msgpack.py ++++ borgbackup-1.4.5/src/borg/helpers/msgpack.py @@ -145,7 +145,7 @@ def is_supported_msgpack(): version_check = os.environ.get('BORG_MSGPACK_VERSION_CHECK', 'yes').strip().lower() return version_check == 'no' or ( - (1, 0, 3) <= msgpack.version[:3] <= (1, 2, 1) and -+ (1, 0, 3) <= msgpack.version[:3] <= (1, 2, 3) and ++ (1, 0, 3) <= msgpack.version[:3] <= (1, 2, 4) and msgpack.version not in [] )
