openSUSE Build Service

Marcus Rueckert (darix) committed 6 months ago (revision 298)

add missing bugnumber

buildservice-autocommit accepted request 1121497 from

Marcus Rueckert (darix) 6 months ago (revision 297)

baserev update by copy to link target

Marcus Rueckert (darix) accepted request 1121496 from

Marcus Rueckert (darix) 6 months ago (revision 296)

- Update to 1.95.1
  - Security:
    - GHSA-mp92-3jfm-3575 / CVE-2023-43796 — Moderate Severity
      Cached device information of remote users can be queried from
      Synapse. This can be used to enumerate the remote users known
      to a homeserver.

buildservice-autocommit accepted request 1120125 from

Marcus Rueckert (darix) 7 months ago (revision 295)

baserev update by copy to link target

Marcus Rueckert (darix) accepted request 1120123 from

Marcus Rueckert (darix) 7 months ago (revision 294)

- Update to 1.95.0

buildservice-autocommit accepted request 1116889 from

Marcus Rueckert (darix) 7 months ago (revision 293)

baserev update by copy to link target

Marcus Rueckert (darix) accepted request 1116888 from

Marcus Rueckert (darix) 7 months ago (revision 292)

- Update to 1.94.0 (boo#1216126 CVE-2023-45129)
  GHSA-5chr-wjw5-3gq4 / CVE-2023-45129 — Moderate Severity
  A malicious server ACL event can impact performance temporarily
  or permanently leading to a persistent denial of service.
  Homeservers running on a closed federation (which presumably do
  not need to use server ACLs) are not affected.

buildservice-autocommit accepted request 1116700 from

Marcus Rueckert (darix) 7 months ago (revision 291)

baserev update by copy to link target

Marcus Rueckert (darix) accepted request 1116682 from

Marcus Rueckert (darix) 7 months ago (revision 290)

- Update to 1.94.0

buildservice-autocommit accepted request 1113708 from

Marcus Rueckert (darix) 7 months ago (revision 289)

baserev update by copy to link target

Marcus Rueckert (darix) accepted request 1113707 from

Marcus Rueckert (darix) 8 months ago (revision 288)

- Update to 1.93.0

Marcus Rueckert (darix) accepted request 1113560 from

Marcus Rueckert (darix) 8 months ago (revision 287)

- Update to 1.92.3
  This release does not affect openSUSE as we do not use the intree
  libwebp
  Upstream changes:
  This is again a security update targeted at mitigating
  CVE-2023-4863. It turns out that libwebp is bundled statically in
  Pillow wheels so we need to update this dependency instead of
  libwebp package at the OS level.
  Unlike what was advertised in 1.92.2 changelog this release also
  impacts PyPI wheels and Debian packages from matrix.org.
  We encourage admins to upgrade as soon as possible.
  Internal Changes
  - Pillow 10.0.1 is now mandatory because of libwebp
    CVE-2023-4863, since Pillow provides libwebp in the wheels.
    (#16347)
- bump all the dependencies which are not available in tumbleweed.

- Update to 1.92.2
  Only fix in this is actually changing the upstream docker
  configuration to mitigate the webp security bug. Does not affect
  our package.

- Update to 1.92.1
  - Bugfixes
    - Revert MSC3861 introspection cache, admin impersonation and
      account lock. (#16258)
  - Internal Changes
    - Fix incorrect docstring for Ratelimiter. (#16255)
    - Update the release script to work on macOS. (#16266)
    - Stop building Ubuntu Kinetic since it is EOL and repos seem

buildservice-autocommit accepted request 1109346 from

Marcus Rueckert (darix) 8 months ago (revision 286)