<?xml version="1.0" encoding="UTF-8"?>
<otherdata xmlns="http://linux.duke.edu/metadata/other" packages="16">
<package pkgid="bf0f0ea1b83486cbd5e292859823196ff3d76889ee6f0c6b1b3b21b53f8dd35d" name="obs-api" arch="noarch">
  <version epoch="0" ver="2.10.31" rel="150600.248.1"/>
  <changelog author="daniel.donisa@suse.com" date="1610452800">- Update to version 2.10.9
  Bugfixes
  ========
  * Frontend:
  - Update redcarpet gem to fix a security vulnerability.</changelog>
  <changelog author="hvogel@suse.com" date="1614254400">- Update to version 2.10.10
  Bugfixes
  ========
  * frontend:
  - CVE-2020-15169:      Potential XSS vulnerability in Action View
  - CVE-2020-8184:       Percent-encoded cookies can be used to overwrite existing
    prefixed cookie names
  - GHSA-g6wq-qcwm-j5g2: ReDoS vulnerability in Sec-WebSocket-Extensions parser
  - GHSA-vr8q-g5c7-m54m: Nokogiri::XML::Schema trusts input by default,
    exposing risk of an XXE vulnerability</changelog>
  <changelog author="hvogel@suse.com" date="1650369600">Update to version 2.10.13
  - Fix XML external entity (XXE) injection in xmlhash
    CVE-2022-21949
  - Update to Ruby 2.7
  - Fix heap memory corruption in yajl-ruby gem
    https://github.com/brianmario/yajl-ruby/security/advisories/GHSA-jj47-x69x-mxrm
  - Fix excessive backtracking in nokogiri gem
    https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-crjr-9rc5-ghw8
  - Fix priviledge escalation issue in ProjectDoProjectReleaseJob (#12407)</changelog>
  <changelog author="adrian@suse.de" date="1651060800">- Update to version 2.10.14
  - support zstd preinstallimages as produced by new build script</changelog>
  <changelog author="lukas.krause@suse.com" date="1651752000">- Update to version 2.10.15
  Bugfixes
  ========
  * Frontend:
  - Fix CVE-2022-22577: There is a possible XSS vulnerability in Rails / Action Pack. CSP headers
    were only sent along with responses that Rails considered as "HTML" responses. This left API
    requests without CSP headers, which could possibly expose users to XSS attacks.
  - Fix CVE-2022-27777: There is a possible XSS vulnerability in Action View tag helpers. Passing
    untrusted input as hash keys can lead to a possible XSS vulnerability</changelog>
  <changelog author="scabrerapadron@suse.de" date="1653566400">- Update to version 2.10.16
  Features
  ========
  Backend:
  * Support for qemu system emulated worker instances
  Bugfixes
  ========
  Frontend:
  * Update Nokogiri to version 1.13.6 to fix two security issues:
  - CVE-2022-29181 Improper Handling of Unexpected Data Type.
  * Update rack to 2.2.3.1
  - CVE-2022-30122 Denial of Service Vulnerability in Rack Multipart Parsing
  - CVE-2022-30123 Possible shell escape sequence injection</changelog>
  <changelog author="daniel.donisa@suse.com" date="1658145600">- Update to version 2.10.17
  Bugfixes
  ========
  Frontend:
  * Bug fix session leaking during BsRequest auto accept
  - See https://github.com/openSUSE/open-build-service/pull/12821
  * Update rails to 5.2.8.1
  - CVE-2022-32224 Possible RCE escalation bug with Serialized Columns in Active Record
  * Update tzinfo from 1.2.9 to 1.2.10
  - CVE-2022-31163 TZInfo relative path traversal vulnerability allows loading of arbitrary files</changelog>
  <changelog author="daniel.donisa@suse.com" date="1671105600">- Update to version 2.10.19
  Bugfixes
  ========
  Frontend:
  * Update rails-html-sanitizer to 1.4.4
  - CVE-2022-32209 Rails::Html::Sanitizer vulnerable to Cross-site Scripting
  * Fix support for qemu system emulated builds via bs_worker</changelog>
  <changelog author="lukas.krause@suse.com" date="1674820800">- Update to version 2.10.20
  Bugfixes
  ========
  Frontend:
  * Update globalid gem from 1.0.0 to 1.0.1
  - Fixes CVE-2023-22799 ReDoS based DoS vulnerability in the GlobalID gem
  * Update rack gem from 2.2.4 to 2.2.6.2
  - Fixes CVE-2022-44571 Denial of service vulnerability in the Content-Disposition parsing
    component of Rack.
  - Fixes CVE-2022-44572 Denial of service vulnerability in the multipart parsing component
    of Rack.
  - Fixes CVE-2022-44570 Possible denial of service vulnerability in the Range header
    parsing component of Rack.</changelog>
  <changelog author="daniel.donisa@suse.com" date="1678968000">- Update to version 2.10.21
  Bugfixes
  ========
  Frontend:
  * Update rack to version 2.2.6.4
  - Fixes CVE-2023-27539 Avoid ReDoS (https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS) in header parsing.
  - Fixes CVE-2023-27530 Possible DoS Vulnerability in Multipart MIME parsing.+</changelog>
  <changelog author="daniel.donisa@suse.com" date="1709294400">- Update to version 2.10.22
  Bugfixes
  ========
  Frontend:
  * Update rack to version 2.2.8.1
  - Fixed ReDoS in Accept header parsing [CVE-2024-26146]
  - Fixed ReDoS in Content Type header parsing [CVE-2024-25126]
  - Reject Range headers which are too large [CVE-2024-26141] DoS Vulnerability in Multipart MIME parsing.</changelog>
  <changelog author="adrian@suse.de" date="1739534400">- Update to version 2.10.24
  * Support usage of scmsync source from remote OBS instances
  * Fix linking of remote backend only packages
  * Handle "manual" source service modes
  * bs_worker: export cpu features as flags (for s390)
  * Update kiwi schema to current state
  * Using 15.6 as default OBS server host OS</changelog>
  <changelog author="dleidi@suse.com" date="1740484800">- Update to version 2.10.25
  Bugfixes
  ========
  Frontend:
  * Update rack to version 2.2.11
  - [CVE-2025-25184] Fix possible log Injection in `Rack::CommonLogger`</changelog>
  <changelog author="enavarro@suse.com" date="1741262400">- Update to version 2.10.26
  Bugfixes
  ========
  Frontend:
  * Update rack RubyGem to version 2.2.12
  - Possible Log Injection in Rack::Sendfile (CVE-2025-27111)</changelog>
  <changelog author="enavarro@suse.com" date="1742299200">- Update to version 2.10.27
  Bugfixes
  ========
  Frontend:
  * Update rack RubyGem to version 2.2.13
  - Local file inclusion in Rack::Static (CVE-2025-27610)</changelog>
  <changelog author="enavarro@suse.com" date="1747396800">- Update to version 2.10.28
  Bugfixes
  ========
  Frontend:
  * Update rack RubyGem to version 2.2.14
  - Unbounded parameter parsing in Rack::QueryParser can lead to memory exhaustion (CVE-2025-46727)</changelog>
  <changelog author="enavarro@suse.com" date="1763640000">- Update to version 2.10.29
  Features
  ========
  Backend:
  * Support added for zstd compressed repomd meta data of download on demand repositories
  Bugfixes
  ========
  Frontend:
  * Update rack RubyGem to version 2.2.20
  - Unbounded parameter parsing in Rack::QueryParser can lead to memory exhaustion via semicolon-separated parameters (CVE-2025-59830)
  - Unbounded multipart preamble buffering enables DoS (memory exhaustion) (CVE-2025-61770)
  - Multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion) (CVE-2025-61771)
  - Multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion) (CVE-2025-61772)
  - Improper handling of headers in Rack::Sendfile may allow proxy bypass (CVE-2025-61780)
  - Unbounded read in Rack::Request form parsing can lead to memory exhaustion (CVE-2025-61919)</changelog>
  <changelog author="adrian@suse.de" date="1765972800">- Update to version 2.10.30
  Features
  ========
  Backend:
  * Switch to GPG version 4 signatures for debian repositories</changelog>
  <changelog author="enavarro@suse.com" date="1773144000">- Update to version 2.10.31
  Bugfixes
  ========
  Frontend:
  * Update rack RubyGem to version 2.2.22
  - XSS injection via malicious filename in Rack::Directory (CVE-2026-25500)
  - Directory traversal via root prefix bypass in Rack::Directory (CVE-2026-22860)</changelog>
  <changelog author="adrian@suse.de" date="1777377600">- Update to version 2.10.32
  * Support for Leap-16.0 and SLES-16.0 as server system added
  * Updated perl-BSSolv dependency library</changelog>
</package>
<package pkgid="117a9b834217ecfa37ebf2a1aae45bc6d307ae4d85340a8b7537e9e0d1299e51" name="obs-api-deps" arch="x86_64">
  <version epoch="0" ver="2.10.31" rel="150600.239.1"/>
  <changelog author="daniel.donisa@suse.com" date="1610452800">- Update to version 2.10.9
  Bugfixes
  ========
  * Frontend:
  - Update redcarpet gem to fix a security vulnerability.</changelog>
  <changelog author="hvogel@suse.com" date="1614254400">- Update to version 2.10.10
  Bugfixes
  ========
  * frontend:
  - CVE-2020-15169:      Potential XSS vulnerability in Action View
  - CVE-2020-8184:       Percent-encoded cookies can be used to overwrite existing
    prefixed cookie names
  - GHSA-g6wq-qcwm-j5g2: ReDoS vulnerability in Sec-WebSocket-Extensions parser
  - GHSA-vr8q-g5c7-m54m: Nokogiri::XML::Schema trusts input by default,
    exposing risk of an XXE vulnerability</changelog>
  <changelog author="hvogel@suse.com" date="1650369600">Update to version 2.10.13
  - Fix XML external entity (XXE) injection in xmlhash
    CVE-2022-21949
  - Update to Ruby 2.7
  - Fix heap memory corruption in yajl-ruby gem
    https://github.com/brianmario/yajl-ruby/security/advisories/GHSA-jj47-x69x-mxrm
  - Fix excessive backtracking in nokogiri gem
    https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-crjr-9rc5-ghw8
  - Fix priviledge escalation issue in ProjectDoProjectReleaseJob (#12407)</changelog>
  <changelog author="adrian@suse.de" date="1651060800">- Update to version 2.10.14
  - support zstd preinstallimages as produced by new build script</changelog>
  <changelog author="lukas.krause@suse.com" date="1651752000">- Update to version 2.10.15
  Bugfixes
  ========
  * Frontend:
  - Fix CVE-2022-22577: There is a possible XSS vulnerability in Rails / Action Pack. CSP headers
    were only sent along with responses that Rails considered as "HTML" responses. This left API
    requests without CSP headers, which could possibly expose users to XSS attacks.
  - Fix CVE-2022-27777: There is a possible XSS vulnerability in Action View tag helpers. Passing
    untrusted input as hash keys can lead to a possible XSS vulnerability</changelog>
  <changelog author="scabrerapadron@suse.de" date="1653566400">- Update to version 2.10.16
  Features
  ========
  Backend:
  * Support for qemu system emulated worker instances
  Bugfixes
  ========
  Frontend:
  * Update Nokogiri to version 1.13.6 to fix two security issues:
  - CVE-2022-29181 Improper Handling of Unexpected Data Type.
  * Update rack to 2.2.3.1
  - CVE-2022-30122 Denial of Service Vulnerability in Rack Multipart Parsing
  - CVE-2022-30123 Possible shell escape sequence injection</changelog>
  <changelog author="daniel.donisa@suse.com" date="1658145600">- Update to version 2.10.17
  Bugfixes
  ========
  Frontend:
  * Bug fix session leaking during BsRequest auto accept
  - See https://github.com/openSUSE/open-build-service/pull/12821
  * Update rails to 5.2.8.1
  - CVE-2022-32224 Possible RCE escalation bug with Serialized Columns in Active Record
  * Update tzinfo from 1.2.9 to 1.2.10
  - CVE-2022-31163 TZInfo relative path traversal vulnerability allows loading of arbitrary files</changelog>
  <changelog author="daniel.donisa@suse.com" date="1671105600">- Update to version 2.10.19
  Bugfixes
  ========
  Frontend:
  * Update rails-html-sanitizer to 1.4.4
  - CVE-2022-32209 Rails::Html::Sanitizer vulnerable to Cross-site Scripting
  * Fix support for qemu system emulated builds via bs_worker</changelog>
  <changelog author="lukas.krause@suse.com" date="1674820800">- Update to version 2.10.20
  Bugfixes
  ========
  Frontend:
  * Update globalid gem from 1.0.0 to 1.0.1
  - Fixes CVE-2023-22799 ReDoS based DoS vulnerability in the GlobalID gem
  * Update rack gem from 2.2.4 to 2.2.6.2
  - Fixes CVE-2022-44571 Denial of service vulnerability in the Content-Disposition parsing
    component of Rack.
  - Fixes CVE-2022-44572 Denial of service vulnerability in the multipart parsing component
    of Rack.
  - Fixes CVE-2022-44570 Possible denial of service vulnerability in the Range header
    parsing component of Rack.</changelog>
  <changelog author="daniel.donisa@suse.com" date="1678968000">- Update to version 2.10.21
  Bugfixes
  ========
  Frontend:
  * Update rack to version 2.2.6.4
  - Fixes CVE-2023-27539 Avoid ReDoS (https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS) in header parsing.
  - Fixes CVE-2023-27530 Possible DoS Vulnerability in Multipart MIME parsing.+</changelog>
  <changelog author="daniel.donisa@suse.com" date="1709294400">- Update to version 2.10.22
  Bugfixes
  ========
  Frontend:
  * Update rack to version 2.2.8.1
  - Fixed ReDoS in Accept header parsing [CVE-2024-26146]
  - Fixed ReDoS in Content Type header parsing [CVE-2024-25126]
  - Reject Range headers which are too large [CVE-2024-26141] DoS Vulnerability in Multipart MIME parsing.</changelog>
  <changelog author="adrian@suse.de" date="1739534400">- Update to version 2.10.24
  * Support usage of scmsync source from remote OBS instances
  * Fix linking of remote backend only packages
  * Handle "manual" source service modes
  * bs_worker: export cpu features as flags (for s390)
  * Update kiwi schema to current state
  * Using 15.6 as default OBS server host OS</changelog>
  <changelog author="dleidi@suse.com" date="1740484800">- Update to version 2.10.25
  Bugfixes
  ========
  Frontend:
  * Update rack to version 2.2.11
  - [CVE-2025-25184] Fix possible log Injection in `Rack::CommonLogger`</changelog>
  <changelog author="enavarro@suse.com" date="1741262400">- Update to version 2.10.26
  Bugfixes
  ========
  Frontend:
  * Update rack RubyGem to version 2.2.12
  - Possible Log Injection in Rack::Sendfile (CVE-2025-27111)</changelog>
  <changelog author="enavarro@suse.com" date="1742299200">- Update to version 2.10.27
  Bugfixes
  ========
  Frontend:
  * Update rack RubyGem to version 2.2.13
  - Local file inclusion in Rack::Static (CVE-2025-27610)</changelog>
  <changelog author="enavarro@suse.com" date="1747396800">- Update to version 2.10.28
  Bugfixes
  ========
  Frontend:
  * Update rack RubyGem to version 2.2.14
  - Unbounded parameter parsing in Rack::QueryParser can lead to memory exhaustion (CVE-2025-46727)</changelog>
  <changelog author="enavarro@suse.com" date="1763640000">- Update to version 2.10.29
  Features
  ========
  Backend:
  * Support added for zstd compressed repomd meta data of download on demand repositories
  Bugfixes
  ========
  Frontend:
  * Update rack RubyGem to version 2.2.20
  - Unbounded parameter parsing in Rack::QueryParser can lead to memory exhaustion via semicolon-separated parameters (CVE-2025-59830)
  - Unbounded multipart preamble buffering enables DoS (memory exhaustion) (CVE-2025-61770)
  - Multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion) (CVE-2025-61771)
  - Multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion) (CVE-2025-61772)
  - Improper handling of headers in Rack::Sendfile may allow proxy bypass (CVE-2025-61780)
  - Unbounded read in Rack::Request form parsing can lead to memory exhaustion (CVE-2025-61919)</changelog>
  <changelog author="adrian@suse.de" date="1765972800">- Update to version 2.10.30
  Features
  ========
  Backend:
  * Switch to GPG version 4 signatures for debian repositories</changelog>
  <changelog author="enavarro@suse.com" date="1773144000">- Update to version 2.10.31
  Bugfixes
  ========
  Frontend:
  * Update rack RubyGem to version 2.2.22
  - XSS injection via malicious filename in Rack::Directory (CVE-2026-25500)
  - Directory traversal via root prefix bypass in Rack::Directory (CVE-2026-22860)</changelog>
  <changelog author="adrian@suse.de" date="1777377600">- Update to version 2.10.32
  * Support for Leap-16.0 and SLES-16.0 as server system added
  * Updated perl-BSSolv dependency library</changelog>
</package>
<package pkgid="855a387f51514f7e4b85873b4cc65943fb9df303817239623b51f62c323761d2" name="obs-api-testsuite-deps" arch="x86_64">
  <version epoch="0" ver="2.10.31" rel="150600.239.1"/>
  <changelog author="daniel.donisa@suse.com" date="1610452800">- Update to version 2.10.9
  Bugfixes
  ========
  * Frontend:
  - Update redcarpet gem to fix a security vulnerability.</changelog>
  <changelog author="hvogel@suse.com" date="1614254400">- Update to version 2.10.10
  Bugfixes
  ========
  * frontend:
  - CVE-2020-15169:      Potential XSS vulnerability in Action View
  - CVE-2020-8184:       Percent-encoded cookies can be used to overwrite existing
    prefixed cookie names
  - GHSA-g6wq-qcwm-j5g2: ReDoS vulnerability in Sec-WebSocket-Extensions parser
  - GHSA-vr8q-g5c7-m54m: Nokogiri::XML::Schema trusts input by default,
    exposing risk of an XXE vulnerability</changelog>
  <changelog author="hvogel@suse.com" date="1650369600">Update to version 2.10.13
  - Fix XML external entity (XXE) injection in xmlhash
    CVE-2022-21949
  - Update to Ruby 2.7
  - Fix heap memory corruption in yajl-ruby gem
    https://github.com/brianmario/yajl-ruby/security/advisories/GHSA-jj47-x69x-mxrm
  - Fix excessive backtracking in nokogiri gem
    https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-crjr-9rc5-ghw8
  - Fix priviledge escalation issue in ProjectDoProjectReleaseJob (#12407)</changelog>
  <changelog author="adrian@suse.de" date="1651060800">- Update to version 2.10.14
  - support zstd preinstallimages as produced by new build script</changelog>
  <changelog author="lukas.krause@suse.com" date="1651752000">- Update to version 2.10.15
  Bugfixes
  ========
  * Frontend:
  - Fix CVE-2022-22577: There is a possible XSS vulnerability in Rails / Action Pack. CSP headers
    were only sent along with responses that Rails considered as "HTML" responses. This left API
    requests without CSP headers, which could possibly expose users to XSS attacks.
  - Fix CVE-2022-27777: There is a possible XSS vulnerability in Action View tag helpers. Passing
    untrusted input as hash keys can lead to a possible XSS vulnerability</changelog>
  <changelog author="scabrerapadron@suse.de" date="1653566400">- Update to version 2.10.16
  Features
  ========
  Backend:
  * Support for qemu system emulated worker instances
  Bugfixes
  ========
  Frontend:
  * Update Nokogiri to version 1.13.6 to fix two security issues:
  - CVE-2022-29181 Improper Handling of Unexpected Data Type.
  * Update rack to 2.2.3.1
  - CVE-2022-30122 Denial of Service Vulnerability in Rack Multipart Parsing
  - CVE-2022-30123 Possible shell escape sequence injection</changelog>
  <changelog author="daniel.donisa@suse.com" date="1658145600">- Update to version 2.10.17
  Bugfixes
  ========
  Frontend:
  * Bug fix session leaking during BsRequest auto accept
  - See https://github.com/openSUSE/open-build-service/pull/12821
  * Update rails to 5.2.8.1
  - CVE-2022-32224 Possible RCE escalation bug with Serialized Columns in Active Record
  * Update tzinfo from 1.2.9 to 1.2.10
  - CVE-2022-31163 TZInfo relative path traversal vulnerability allows loading of arbitrary files</changelog>
  <changelog author="daniel.donisa@suse.com" date="1671105600">- Update to version 2.10.19
  Bugfixes
  ========
  Frontend:
  * Update rails-html-sanitizer to 1.4.4
  - CVE-2022-32209 Rails::Html::Sanitizer vulnerable to Cross-site Scripting
  * Fix support for qemu system emulated builds via bs_worker</changelog>
  <changelog author="lukas.krause@suse.com" date="1674820800">- Update to version 2.10.20
  Bugfixes
  ========
  Frontend:
  * Update globalid gem from 1.0.0 to 1.0.1
  - Fixes CVE-2023-22799 ReDoS based DoS vulnerability in the GlobalID gem
  * Update rack gem from 2.2.4 to 2.2.6.2
  - Fixes CVE-2022-44571 Denial of service vulnerability in the Content-Disposition parsing
    component of Rack.
  - Fixes CVE-2022-44572 Denial of service vulnerability in the multipart parsing component
    of Rack.
  - Fixes CVE-2022-44570 Possible denial of service vulnerability in the Range header
    parsing component of Rack.</changelog>
  <changelog author="daniel.donisa@suse.com" date="1678968000">- Update to version 2.10.21
  Bugfixes
  ========
  Frontend:
  * Update rack to version 2.2.6.4
  - Fixes CVE-2023-27539 Avoid ReDoS (https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS) in header parsing.
  - Fixes CVE-2023-27530 Possible DoS Vulnerability in Multipart MIME parsing.+</changelog>
  <changelog author="daniel.donisa@suse.com" date="1709294400">- Update to version 2.10.22
  Bugfixes
  ========
  Frontend:
  * Update rack to version 2.2.8.1
  - Fixed ReDoS in Accept header parsing [CVE-2024-26146]
  - Fixed ReDoS in Content Type header parsing [CVE-2024-25126]
  - Reject Range headers which are too large [CVE-2024-26141] DoS Vulnerability in Multipart MIME parsing.</changelog>
  <changelog author="adrian@suse.de" date="1739534400">- Update to version 2.10.24
  * Support usage of scmsync source from remote OBS instances
  * Fix linking of remote backend only packages
  * Handle "manual" source service modes
  * bs_worker: export cpu features as flags (for s390)
  * Update kiwi schema to current state
  * Using 15.6 as default OBS server host OS</changelog>
  <changelog author="dleidi@suse.com" date="1740484800">- Update to version 2.10.25
  Bugfixes
  ========
  Frontend:
  * Update rack to version 2.2.11
  - [CVE-2025-25184] Fix possible log Injection in `Rack::CommonLogger`</changelog>
  <changelog author="enavarro@suse.com" date="1741262400">- Update to version 2.10.26
  Bugfixes
  ========
  Frontend:
  * Update rack RubyGem to version 2.2.12
  - Possible Log Injection in Rack::Sendfile (CVE-2025-27111)</changelog>
  <changelog author="enavarro@suse.com" date="1742299200">- Update to version 2.10.27
  Bugfixes
  ========
  Frontend:
  * Update rack RubyGem to version 2.2.13
  - Local file inclusion in Rack::Static (CVE-2025-27610)</changelog>
  <changelog author="enavarro@suse.com" date="1747396800">- Update to version 2.10.28
  Bugfixes
  ========
  Frontend:
  * Update rack RubyGem to version 2.2.14
  - Unbounded parameter parsing in Rack::QueryParser can lead to memory exhaustion (CVE-2025-46727)</changelog>
  <changelog author="enavarro@suse.com" date="1763640000">- Update to version 2.10.29
  Features
  ========
  Backend:
  * Support added for zstd compressed repomd meta data of download on demand repositories
  Bugfixes
  ========
  Frontend:
  * Update rack RubyGem to version 2.2.20
  - Unbounded parameter parsing in Rack::QueryParser can lead to memory exhaustion via semicolon-separated parameters (CVE-2025-59830)
  - Unbounded multipart preamble buffering enables DoS (memory exhaustion) (CVE-2025-61770)
  - Multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion) (CVE-2025-61771)
  - Multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion) (CVE-2025-61772)
  - Improper handling of headers in Rack::Sendfile may allow proxy bypass (CVE-2025-61780)
  - Unbounded read in Rack::Request form parsing can lead to memory exhaustion (CVE-2025-61919)</changelog>
  <changelog author="adrian@suse.de" date="1765972800">- Update to version 2.10.30
  Features
  ========
  Backend:
  * Switch to GPG version 4 signatures for debian repositories</changelog>
  <changelog author="enavarro@suse.com" date="1773144000">- Update to version 2.10.31
  Bugfixes
  ========
  Frontend:
  * Update rack RubyGem to version 2.2.22
  - XSS injection via malicious filename in Rack::Directory (CVE-2026-25500)
  - Directory traversal via root prefix bypass in Rack::Directory (CVE-2026-22860)</changelog>
  <changelog author="adrian@suse.de" date="1777377600">- Update to version 2.10.32
  * Support for Leap-16.0 and SLES-16.0 as server system added
  * Updated perl-BSSolv dependency library</changelog>
</package>
<package pkgid="bf224910821a896eeed2d9e5ee418a5f5e1506542e893675a635534ed41d37f6" name="obs-backend-testsuite" arch="noarch">
  <version epoch="0" ver="2.10.31" rel="150600.248.1"/>
  <changelog author="daniel.donisa@suse.com" date="1610452800">- Update to version 2.10.9
  Bugfixes
  ========
  * Frontend:
  - Update redcarpet gem to fix a security vulnerability.</changelog>
  <changelog author="hvogel@suse.com" date="1614254400">- Update to version 2.10.10
  Bugfixes
  ========
  * frontend:
  - CVE-2020-15169:      Potential XSS vulnerability in Action View
  - CVE-2020-8184:       Percent-encoded cookies can be used to overwrite existing
    prefixed cookie names
  - GHSA-g6wq-qcwm-j5g2: ReDoS vulnerability in Sec-WebSocket-Extensions parser
  - GHSA-vr8q-g5c7-m54m: Nokogiri::XML::Schema trusts input by default,
    exposing risk of an XXE vulnerability</changelog>
  <changelog author="hvogel@suse.com" date="1650369600">Update to version 2.10.13
  - Fix XML external entity (XXE) injection in xmlhash
    CVE-2022-21949
  - Update to Ruby 2.7
  - Fix heap memory corruption in yajl-ruby gem
    https://github.com/brianmario/yajl-ruby/security/advisories/GHSA-jj47-x69x-mxrm
  - Fix excessive backtracking in nokogiri gem
    https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-crjr-9rc5-ghw8
  - Fix priviledge escalation issue in ProjectDoProjectReleaseJob (#12407)</changelog>
  <changelog author="adrian@suse.de" date="1651060800">- Update to version 2.10.14
  - support zstd preinstallimages as produced by new build script</changelog>
  <changelog author="lukas.krause@suse.com" date="1651752000">- Update to version 2.10.15
  Bugfixes
  ========
  * Frontend:
  - Fix CVE-2022-22577: There is a possible XSS vulnerability in Rails / Action Pack. CSP headers
    were only sent along with responses that Rails considered as "HTML" responses. This left API
    requests without CSP headers, which could possibly expose users to XSS attacks.
  - Fix CVE-2022-27777: There is a possible XSS vulnerability in Action View tag helpers. Passing
    untrusted input as hash keys can lead to a possible XSS vulnerability</changelog>
  <changelog author="scabrerapadron@suse.de" date="1653566400">- Update to version 2.10.16
  Features
  ========
  Backend:
  * Support for qemu system emulated worker instances
  Bugfixes
  ========
  Frontend:
  * Update Nokogiri to version 1.13.6 to fix two security issues:
  - CVE-2022-29181 Improper Handling of Unexpected Data Type.
  * Update rack to 2.2.3.1
  - CVE-2022-30122 Denial of Service Vulnerability in Rack Multipart Parsing
  - CVE-2022-30123 Possible shell escape sequence injection</changelog>
  <changelog author="daniel.donisa@suse.com" date="1658145600">- Update to version 2.10.17
  Bugfixes
  ========
  Frontend:
  * Bug fix session leaking during BsRequest auto accept
  - See https://github.com/openSUSE/open-build-service/pull/12821
  * Update rails to 5.2.8.1
  - CVE-2022-32224 Possible RCE escalation bug with Serialized Columns in Active Record
  * Update tzinfo from 1.2.9 to 1.2.10
  - CVE-2022-31163 TZInfo relative path traversal vulnerability allows loading of arbitrary files</changelog>
  <changelog author="daniel.donisa@suse.com" date="1671105600">- Update to version 2.10.19
  Bugfixes
  ========
  Frontend:
  * Update rails-html-sanitizer to 1.4.4
  - CVE-2022-32209 Rails::Html::Sanitizer vulnerable to Cross-site Scripting
  * Fix support for qemu system emulated builds via bs_worker</changelog>
  <changelog author="lukas.krause@suse.com" date="1674820800">- Update to version 2.10.20
  Bugfixes
  ========
  Frontend:
  * Update globalid gem from 1.0.0 to 1.0.1
  - Fixes CVE-2023-22799 ReDoS based DoS vulnerability in the GlobalID gem
  * Update rack gem from 2.2.4 to 2.2.6.2
  - Fixes CVE-2022-44571 Denial of service vulnerability in the Content-Disposition parsing
    component of Rack.
  - Fixes CVE-2022-44572 Denial of service vulnerability in the multipart parsing component
    of Rack.
  - Fixes CVE-2022-44570 Possible denial of service vulnerability in the Range header
    parsing component of Rack.</changelog>
  <changelog author="daniel.donisa@suse.com" date="1678968000">- Update to version 2.10.21
  Bugfixes
  ========
  Frontend:
  * Update rack to version 2.2.6.4
  - Fixes CVE-2023-27539 Avoid ReDoS (https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS) in header parsing.
  - Fixes CVE-2023-27530 Possible DoS Vulnerability in Multipart MIME parsing.+</changelog>
  <changelog author="daniel.donisa@suse.com" date="1709294400">- Update to version 2.10.22
  Bugfixes
  ========
  Frontend:
  * Update rack to version 2.2.8.1
  - Fixed ReDoS in Accept header parsing [CVE-2024-26146]
  - Fixed ReDoS in Content Type header parsing [CVE-2024-25126]
  - Reject Range headers which are too large [CVE-2024-26141] DoS Vulnerability in Multipart MIME parsing.</changelog>
  <changelog author="adrian@suse.de" date="1739534400">- Update to version 2.10.24
  * Support usage of scmsync source from remote OBS instances
  * Fix linking of remote backend only packages
  * Handle "manual" source service modes
  * bs_worker: export cpu features as flags (for s390)
  * Update kiwi schema to current state
  * Using 15.6 as default OBS server host OS</changelog>
  <changelog author="dleidi@suse.com" date="1740484800">- Update to version 2.10.25
  Bugfixes
  ========
  Frontend:
  * Update rack to version 2.2.11
  - [CVE-2025-25184] Fix possible log Injection in `Rack::CommonLogger`</changelog>
  <changelog author="enavarro@suse.com" date="1741262400">- Update to version 2.10.26
  Bugfixes
  ========
  Frontend:
  * Update rack RubyGem to version 2.2.12
  - Possible Log Injection in Rack::Sendfile (CVE-2025-27111)</changelog>
  <changelog author="enavarro@suse.com" date="1742299200">- Update to version 2.10.27
  Bugfixes
  ========
  Frontend:
  * Update rack RubyGem to version 2.2.13
  - Local file inclusion in Rack::Static (CVE-2025-27610)</changelog>
  <changelog author="enavarro@suse.com" date="1747396800">- Update to version 2.10.28
  Bugfixes
  ========
  Frontend:
  * Update rack RubyGem to version 2.2.14
  - Unbounded parameter parsing in Rack::QueryParser can lead to memory exhaustion (CVE-2025-46727)</changelog>
  <changelog author="enavarro@suse.com" date="1763640000">- Update to version 2.10.29
  Features
  ========
  Backend:
  * Support added for zstd compressed repomd meta data of download on demand repositories
  Bugfixes
  ========
  Frontend:
  * Update rack RubyGem to version 2.2.20
  - Unbounded parameter parsing in Rack::QueryParser can lead to memory exhaustion via semicolon-separated parameters (CVE-2025-59830)
  - Unbounded multipart preamble buffering enables DoS (memory exhaustion) (CVE-2025-61770)
  - Multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion) (CVE-2025-61771)
  - Multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion) (CVE-2025-61772)
  - Improper handling of headers in Rack::Sendfile may allow proxy bypass (CVE-2025-61780)
  - Unbounded read in Rack::Request form parsing can lead to memory exhaustion (CVE-2025-61919)</changelog>
  <changelog author="adrian@suse.de" date="1765972800">- Update to version 2.10.30
  Features
  ========
  Backend:
  * Switch to GPG version 4 signatures for debian repositories</changelog>
  <changelog author="enavarro@suse.com" date="1773144000">- Update to version 2.10.31
  Bugfixes
  ========
  Frontend:
  * Update rack RubyGem to version 2.2.22
  - XSS injection via malicious filename in Rack::Directory (CVE-2026-25500)
  - Directory traversal via root prefix bypass in Rack::Directory (CVE-2026-22860)</changelog>
  <changelog author="adrian@suse.de" date="1777377600">- Update to version 2.10.32
  * Support for Leap-16.0 and SLES-16.0 as server system added
  * Updated perl-BSSolv dependency library</changelog>
</package>
<package pkgid="61c3241bcbe2780e8215f885d73fbab0e5908af93bb08febe24e410ca00a6ab8" name="obs-bundled-gems" arch="src">
  <version epoch="0" ver="2.10.31" rel="150600.239.1"/>
  <changelog author="daniel.donisa@suse.com" date="1610452800">- Update to version 2.10.9
  Bugfixes
  ========
  * Frontend:
  - Update redcarpet gem to fix a security vulnerability.</changelog>
  <changelog author="hvogel@suse.com" date="1614254400">- Update to version 2.10.10
  Bugfixes
  ========
  * frontend:
  - CVE-2020-15169:      Potential XSS vulnerability in Action View
  - CVE-2020-8184:       Percent-encoded cookies can be used to overwrite existing
    prefixed cookie names
  - GHSA-g6wq-qcwm-j5g2: ReDoS vulnerability in Sec-WebSocket-Extensions parser
  - GHSA-vr8q-g5c7-m54m: Nokogiri::XML::Schema trusts input by default,
    exposing risk of an XXE vulnerability</changelog>
  <changelog author="hvogel@suse.com" date="1650369600">Update to version 2.10.13
  - Fix XML external entity (XXE) injection in xmlhash
    CVE-2022-21949
  - Update to Ruby 2.7
  - Fix heap memory corruption in yajl-ruby gem
    https://github.com/brianmario/yajl-ruby/security/advisories/GHSA-jj47-x69x-mxrm
  - Fix excessive backtracking in nokogiri gem
    https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-crjr-9rc5-ghw8
  - Fix priviledge escalation issue in ProjectDoProjectReleaseJob (#12407)</changelog>
  <changelog author="adrian@suse.de" date="1651060800">- Update to version 2.10.14
  - support zstd preinstallimages as produced by new build script</changelog>
  <changelog author="lukas.krause@suse.com" date="1651752000">- Update to version 2.10.15
  Bugfixes
  ========
  * Frontend:
  - Fix CVE-2022-22577: There is a possible XSS vulnerability in Rails / Action Pack. CSP headers
    were only sent along with responses that Rails considered as "HTML" responses. This left API
    requests without CSP headers, which could possibly expose users to XSS attacks.
  - Fix CVE-2022-27777: There is a possible XSS vulnerability in Action View tag helpers. Passing
    untrusted input as hash keys can lead to a possible XSS vulnerability</changelog>
  <changelog author="scabrerapadron@suse.de" date="1653566400">- Update to version 2.10.16
  Features
  ========
  Backend:
  * Support for qemu system emulated worker instances
  Bugfixes
  ========
  Frontend:
  * Update Nokogiri to version 1.13.6 to fix two security issues:
  - CVE-2022-29181 Improper Handling of Unexpected Data Type.
  * Update rack to 2.2.3.1
  - CVE-2022-30122 Denial of Service Vulnerability in Rack Multipart Parsing
  - CVE-2022-30123 Possible shell escape sequence injection</changelog>
  <changelog author="daniel.donisa@suse.com" date="1658145600">- Update to version 2.10.17
  Bugfixes
  ========
  Frontend:
  * Bug fix session leaking during BsRequest auto accept
  - See https://github.com/openSUSE/open-build-service/pull/12821
  * Update rails to 5.2.8.1
  - CVE-2022-32224 Possible RCE escalation bug with Serialized Columns in Active Record
  * Update tzinfo from 1.2.9 to 1.2.10
  - CVE-2022-31163 TZInfo relative path traversal vulnerability allows loading of arbitrary files</changelog>
  <changelog author="daniel.donisa@suse.com" date="1671105600">- Update to version 2.10.19
  Bugfixes
  ========
  Frontend:
  * Update rails-html-sanitizer to 1.4.4
  - CVE-2022-32209 Rails::Html::Sanitizer vulnerable to Cross-site Scripting
  * Fix support for qemu system emulated builds via bs_worker</changelog>
  <changelog author="lukas.krause@suse.com" date="1674820800">- Update to version 2.10.20
  Bugfixes
  ========
  Frontend:
  * Update globalid gem from 1.0.0 to 1.0.1
  - Fixes CVE-2023-22799 ReDoS based DoS vulnerability in the GlobalID gem
  * Update rack gem from 2.2.4 to 2.2.6.2
  - Fixes CVE-2022-44571 Denial of service vulnerability in the Content-Disposition parsing
    component of Rack.
  - Fixes CVE-2022-44572 Denial of service vulnerability in the multipart parsing component
    of Rack.
  - Fixes CVE-2022-44570 Possible denial of service vulnerability in the Range header
    parsing component of Rack.</changelog>
  <changelog author="daniel.donisa@suse.com" date="1678968000">- Update to version 2.10.21
  Bugfixes
  ========
  Frontend:
  * Update rack to version 2.2.6.4
  - Fixes CVE-2023-27539 Avoid ReDoS (https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS) in header parsing.
  - Fixes CVE-2023-27530 Possible DoS Vulnerability in Multipart MIME parsing.+</changelog>
  <changelog author="daniel.donisa@suse.com" date="1709294400">- Update to version 2.10.22
  Bugfixes
  ========
  Frontend:
  * Update rack to version 2.2.8.1
  - Fixed ReDoS in Accept header parsing [CVE-2024-26146]
  - Fixed ReDoS in Content Type header parsing [CVE-2024-25126]
  - Reject Range headers which are too large [CVE-2024-26141] DoS Vulnerability in Multipart MIME parsing.</changelog>
  <changelog author="adrian@suse.de" date="1739534400">- Update to version 2.10.24
  * Support usage of scmsync source from remote OBS instances
  * Fix linking of remote backend only packages
  * Handle "manual" source service modes
  * bs_worker: export cpu features as flags (for s390)
  * Update kiwi schema to current state
  * Using 15.6 as default OBS server host OS</changelog>
  <changelog author="dleidi@suse.com" date="1740484800">- Update to version 2.10.25
  Bugfixes
  ========
  Frontend:
  * Update rack to version 2.2.11
  - [CVE-2025-25184] Fix possible log Injection in `Rack::CommonLogger`</changelog>
  <changelog author="enavarro@suse.com" date="1741262400">- Update to version 2.10.26
  Bugfixes
  ========
  Frontend:
  * Update rack RubyGem to version 2.2.12
  - Possible Log Injection in Rack::Sendfile (CVE-2025-27111)</changelog>
  <changelog author="enavarro@suse.com" date="1742299200">- Update to version 2.10.27
  Bugfixes
  ========
  Frontend:
  * Update rack RubyGem to version 2.2.13
  - Local file inclusion in Rack::Static (CVE-2025-27610)</changelog>
  <changelog author="enavarro@suse.com" date="1747396800">- Update to version 2.10.28
  Bugfixes
  ========
  Frontend:
  * Update rack RubyGem to version 2.2.14
  - Unbounded parameter parsing in Rack::QueryParser can lead to memory exhaustion (CVE-2025-46727)</changelog>
  <changelog author="enavarro@suse.com" date="1763640000">- Update to version 2.10.29
  Features
  ========
  Backend:
  * Support added for zstd compressed repomd meta data of download on demand repositories
  Bugfixes
  ========
  Frontend:
  * Update rack RubyGem to version 2.2.20
  - Unbounded parameter parsing in Rack::QueryParser can lead to memory exhaustion via semicolon-separated parameters (CVE-2025-59830)
  - Unbounded multipart preamble buffering enables DoS (memory exhaustion) (CVE-2025-61770)
  - Multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion) (CVE-2025-61771)
  - Multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion) (CVE-2025-61772)
  - Improper handling of headers in Rack::Sendfile may allow proxy bypass (CVE-2025-61780)
  - Unbounded read in Rack::Request form parsing can lead to memory exhaustion (CVE-2025-61919)</changelog>
  <changelog author="adrian@suse.de" date="1765972800">- Update to version 2.10.30
  Features
  ========
  Backend:
  * Switch to GPG version 4 signatures for debian repositories</changelog>
  <changelog author="enavarro@suse.com" date="1773144000">- Update to version 2.10.31
  Bugfixes
  ========
  Frontend:
  * Update rack RubyGem to version 2.2.22
  - XSS injection via malicious filename in Rack::Directory (CVE-2026-25500)
  - Directory traversal via root prefix bypass in Rack::Directory (CVE-2026-22860)</changelog>
  <changelog author="adrian@suse.de" date="1777377600">- Update to version 2.10.32
  * Support for Leap-16.0 and SLES-16.0 as server system added
  * Updated perl-BSSolv dependency library</changelog>
</package>
<package pkgid="1b05af3431e57d2fa034940b0a66388fe9f0800b0b91e343a839aafe0694279d" name="obs-bundled-gems" arch="x86_64">
  <version epoch="0" ver="2.10.31" rel="150600.239.1"/>
  <changelog author="daniel.donisa@suse.com" date="1610452800">- Update to version 2.10.9
  Bugfixes
  ========
  * Frontend:
  - Update redcarpet gem to fix a security vulnerability.</changelog>
  <changelog author="hvogel@suse.com" date="1614254400">- Update to version 2.10.10
  Bugfixes
  ========
  * frontend:
  - CVE-2020-15169:      Potential XSS vulnerability in Action View
  - CVE-2020-8184:       Percent-encoded cookies can be used to overwrite existing
    prefixed cookie names
  - GHSA-g6wq-qcwm-j5g2: ReDoS vulnerability in Sec-WebSocket-Extensions parser
  - GHSA-vr8q-g5c7-m54m: Nokogiri::XML::Schema trusts input by default,
    exposing risk of an XXE vulnerability</changelog>
  <changelog author="hvogel@suse.com" date="1650369600">Update to version 2.10.13
  - Fix XML external entity (XXE) injection in xmlhash
    CVE-2022-21949
  - Update to Ruby 2.7
  - Fix heap memory corruption in yajl-ruby gem
    https://github.com/brianmario/yajl-ruby/security/advisories/GHSA-jj47-x69x-mxrm
  - Fix excessive backtracking in nokogiri gem
    https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-crjr-9rc5-ghw8
  - Fix priviledge escalation issue in ProjectDoProjectReleaseJob (#12407)</changelog>
  <changelog author="adrian@suse.de" date="1651060800">- Update to version 2.10.14
  - support zstd preinstallimages as produced by new build script</changelog>
  <changelog author="lukas.krause@suse.com" date="1651752000">- Update to version 2.10.15
  Bugfixes
  ========
  * Frontend:
  - Fix CVE-2022-22577: There is a possible XSS vulnerability in Rails / Action Pack. CSP headers
    were only sent along with responses that Rails considered as "HTML" responses. This left API
    requests without CSP headers, which could possibly expose users to XSS attacks.
  - Fix CVE-2022-27777: There is a possible XSS vulnerability in Action View tag helpers. Passing
    untrusted input as hash keys can lead to a possible XSS vulnerability</changelog>
  <changelog author="scabrerapadron@suse.de" date="1653566400">- Update to version 2.10.16
  Features
  ========
  Backend:
  * Support for qemu system emulated worker instances
  Bugfixes
  ========
  Frontend:
  * Update Nokogiri to version 1.13.6 to fix two security issues:
  - CVE-2022-29181 Improper Handling of Unexpected Data Type.
  * Update rack to 2.2.3.1
  - CVE-2022-30122 Denial of Service Vulnerability in Rack Multipart Parsing
  - CVE-2022-30123 Possible shell escape sequence injection</changelog>
  <changelog author="daniel.donisa@suse.com" date="1658145600">- Update to version 2.10.17
  Bugfixes
  ========
  Frontend:
  * Bug fix session leaking during BsRequest auto accept
  - See https://github.com/openSUSE/open-build-service/pull/12821
  * Update rails to 5.2.8.1
  - CVE-2022-32224 Possible RCE escalation bug with Serialized Columns in Active Record
  * Update tzinfo from 1.2.9 to 1.2.10
  - CVE-2022-31163 TZInfo relative path traversal vulnerability allows loading of arbitrary files</changelog>
  <changelog author="daniel.donisa@suse.com" date="1671105600">- Update to version 2.10.19
  Bugfixes
  ========
  Frontend:
  * Update rails-html-sanitizer to 1.4.4
  - CVE-2022-32209 Rails::Html::Sanitizer vulnerable to Cross-site Scripting
  * Fix support for qemu system emulated builds via bs_worker</changelog>
  <changelog author="lukas.krause@suse.com" date="1674820800">- Update to version 2.10.20
  Bugfixes
  ========
  Frontend:
  * Update globalid gem from 1.0.0 to 1.0.1
  - Fixes CVE-2023-22799 ReDoS based DoS vulnerability in the GlobalID gem
  * Update rack gem from 2.2.4 to 2.2.6.2
  - Fixes CVE-2022-44571 Denial of service vulnerability in the Content-Disposition parsing
    component of Rack.
  - Fixes CVE-2022-44572 Denial of service vulnerability in the multipart parsing component
    of Rack.
  - Fixes CVE-2022-44570 Possible denial of service vulnerability in the Range header
    parsing component of Rack.</changelog>
  <changelog author="daniel.donisa@suse.com" date="1678968000">- Update to version 2.10.21
  Bugfixes
  ========
  Frontend:
  * Update rack to version 2.2.6.4
  - Fixes CVE-2023-27539 Avoid ReDoS (https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS) in header parsing.
  - Fixes CVE-2023-27530 Possible DoS Vulnerability in Multipart MIME parsing.+</changelog>
  <changelog author="daniel.donisa@suse.com" date="1709294400">- Update to version 2.10.22
  Bugfixes
  ========
  Frontend:
  * Update rack to version 2.2.8.1
  - Fixed ReDoS in Accept header parsing [CVE-2024-26146]
  - Fixed ReDoS in Content Type header parsing [CVE-2024-25126]
  - Reject Range headers which are too large [CVE-2024-26141] DoS Vulnerability in Multipart MIME parsing.</changelog>
  <changelog author="adrian@suse.de" date="1739534400">- Update to version 2.10.24
  * Support usage of scmsync source from remote OBS instances
  * Fix linking of remote backend only packages
  * Handle "manual" source service modes
  * bs_worker: export cpu features as flags (for s390)
  * Update kiwi schema to current state
  * Using 15.6 as default OBS server host OS</changelog>
  <changelog author="dleidi@suse.com" date="1740484800">- Update to version 2.10.25
  Bugfixes
  ========
  Frontend:
  * Update rack to version 2.2.11
  - [CVE-2025-25184] Fix possible log Injection in `Rack::CommonLogger`</changelog>
  <changelog author="enavarro@suse.com" date="1741262400">- Update to version 2.10.26
  Bugfixes
  ========
  Frontend:
  * Update rack RubyGem to version 2.2.12
  - Possible Log Injection in Rack::Sendfile (CVE-2025-27111)</changelog>
  <changelog author="enavarro@suse.com" date="1742299200">- Update to version 2.10.27
  Bugfixes
  ========
  Frontend:
  * Update rack RubyGem to version 2.2.13
  - Local file inclusion in Rack::Static (CVE-2025-27610)</changelog>
  <changelog author="enavarro@suse.com" date="1747396800">- Update to version 2.10.28
  Bugfixes
  ========
  Frontend:
  * Update rack RubyGem to version 2.2.14
  - Unbounded parameter parsing in Rack::QueryParser can lead to memory exhaustion (CVE-2025-46727)</changelog>
  <changelog author="enavarro@suse.com" date="1763640000">- Update to version 2.10.29
  Features
  ========
  Backend:
  * Support added for zstd compressed repomd meta data of download on demand repositories
  Bugfixes
  ========
  Frontend:
  * Update rack RubyGem to version 2.2.20
  - Unbounded parameter parsing in Rack::QueryParser can lead to memory exhaustion via semicolon-separated parameters (CVE-2025-59830)
  - Unbounded multipart preamble buffering enables DoS (memory exhaustion) (CVE-2025-61770)
  - Multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion) (CVE-2025-61771)
  - Multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion) (CVE-2025-61772)
  - Improper handling of headers in Rack::Sendfile may allow proxy bypass (CVE-2025-61780)
  - Unbounded read in Rack::Request form parsing can lead to memory exhaustion (CVE-2025-61919)</changelog>
  <changelog author="adrian@suse.de" date="1765972800">- Update to version 2.10.30
  Features
  ========
  Backend:
  * Switch to GPG version 4 signatures for debian repositories</changelog>
  <changelog author="enavarro@suse.com" date="1773144000">- Update to version 2.10.31
  Bugfixes
  ========
  Frontend:
  * Update rack RubyGem to version 2.2.22
  - XSS injection via malicious filename in Rack::Directory (CVE-2026-25500)
  - Directory traversal via root prefix bypass in Rack::Directory (CVE-2026-22860)</changelog>
  <changelog author="adrian@suse.de" date="1777377600">- Update to version 2.10.32
  * Support for Leap-16.0 and SLES-16.0 as server system added
  * Updated perl-BSSolv dependency library</changelog>
</package>
<package pkgid="933c08101fac060bc4e30ea51856d279301ca699b4c640ba8f1ced48b410c051" name="obs-cloud-uploader" arch="noarch">
  <version epoch="0" ver="2.10.31" rel="150600.248.1"/>
  <changelog author="daniel.donisa@suse.com" date="1610452800">- Update to version 2.10.9
  Bugfixes
  ========
  * Frontend:
  - Update redcarpet gem to fix a security vulnerability.</changelog>
  <changelog author="hvogel@suse.com" date="1614254400">- Update to version 2.10.10
  Bugfixes
  ========
  * frontend:
  - CVE-2020-15169:      Potential XSS vulnerability in Action View
  - CVE-2020-8184:       Percent-encoded cookies can be used to overwrite existing
    prefixed cookie names
  - GHSA-g6wq-qcwm-j5g2: ReDoS vulnerability in Sec-WebSocket-Extensions parser
  - GHSA-vr8q-g5c7-m54m: Nokogiri::XML::Schema trusts input by default,
    exposing risk of an XXE vulnerability</changelog>
  <changelog author="hvogel@suse.com" date="1650369600">Update to version 2.10.13
  - Fix XML external entity (XXE) injection in xmlhash
    CVE-2022-21949
  - Update to Ruby 2.7
  - Fix heap memory corruption in yajl-ruby gem
    https://github.com/brianmario/yajl-ruby/security/advisories/GHSA-jj47-x69x-mxrm
  - Fix excessive backtracking in nokogiri gem
    https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-crjr-9rc5-ghw8
  - Fix priviledge escalation issue in ProjectDoProjectReleaseJob (#12407)</changelog>
  <changelog author="adrian@suse.de" date="1651060800">- Update to version 2.10.14
  - support zstd preinstallimages as produced by new build script</changelog>
  <changelog author="lukas.krause@suse.com" date="1651752000">- Update to version 2.10.15
  Bugfixes
  ========
  * Frontend:
  - Fix CVE-2022-22577: There is a possible XSS vulnerability in Rails / Action Pack. CSP headers
    were only sent along with responses that Rails considered as "HTML" responses. This left API
    requests without CSP headers, which could possibly expose users to XSS attacks.
  - Fix CVE-2022-27777: There is a possible XSS vulnerability in Action View tag helpers. Passing
    untrusted input as hash keys can lead to a possible XSS vulnerability</changelog>
  <changelog author="scabrerapadron@suse.de" date="1653566400">- Update to version 2.10.16
  Features
  ========
  Backend:
  * Support for qemu system emulated worker instances
  Bugfixes
  ========
  Frontend:
  * Update Nokogiri to version 1.13.6 to fix two security issues:
  - CVE-2022-29181 Improper Handling of Unexpected Data Type.
  * Update rack to 2.2.3.1
  - CVE-2022-30122 Denial of Service Vulnerability in Rack Multipart Parsing
  - CVE-2022-30123 Possible shell escape sequence injection</changelog>
  <changelog author="daniel.donisa@suse.com" date="1658145600">- Update to version 2.10.17
  Bugfixes
  ========
  Frontend:
  * Bug fix session leaking during BsRequest auto accept
  - See https://github.com/openSUSE/open-build-service/pull/12821
  * Update rails to 5.2.8.1
  - CVE-2022-32224 Possible RCE escalation bug with Serialized Columns in Active Record
  * Update tzinfo from 1.2.9 to 1.2.10
  - CVE-2022-31163 TZInfo relative path traversal vulnerability allows loading of arbitrary files</changelog>
  <changelog author="daniel.donisa@suse.com" date="1671105600">- Update to version 2.10.19
  Bugfixes
  ========
  Frontend:
  * Update rails-html-sanitizer to 1.4.4
  - CVE-2022-32209 Rails::Html::Sanitizer vulnerable to Cross-site Scripting
  * Fix support for qemu system emulated builds via bs_worker</changelog>
  <changelog author="lukas.krause@suse.com" date="1674820800">- Update to version 2.10.20
  Bugfixes
  ========
  Frontend:
  * Update globalid gem from 1.0.0 to 1.0.1
  - Fixes CVE-2023-22799 ReDoS based DoS vulnerability in the GlobalID gem
  * Update rack gem from 2.2.4 to 2.2.6.2
  - Fixes CVE-2022-44571 Denial of service vulnerability in the Content-Disposition parsing
    component of Rack.
  - Fixes CVE-2022-44572 Denial of service vulnerability in the multipart parsing component
    of Rack.
  - Fixes CVE-2022-44570 Possible denial of service vulnerability in the Range header
    parsing component of Rack.</changelog>
  <changelog author="daniel.donisa@suse.com" date="1678968000">- Update to version 2.10.21
  Bugfixes
  ========
  Frontend:
  * Update rack to version 2.2.6.4
  - Fixes CVE-2023-27539 Avoid ReDoS (https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS) in header parsing.
  - Fixes CVE-2023-27530 Possible DoS Vulnerability in Multipart MIME parsing.+</changelog>
  <changelog author="daniel.donisa@suse.com" date="1709294400">- Update to version 2.10.22
  Bugfixes
  ========
  Frontend:
  * Update rack to version 2.2.8.1
  - Fixed ReDoS in Accept header parsing [CVE-2024-26146]
  - Fixed ReDoS in Content Type header parsing [CVE-2024-25126]
  - Reject Range headers which are too large [CVE-2024-26141] DoS Vulnerability in Multipart MIME parsing.</changelog>
  <changelog author="adrian@suse.de" date="1739534400">- Update to version 2.10.24
  * Support usage of scmsync source from remote OBS instances
  * Fix linking of remote backend only packages
  * Handle "manual" source service modes
  * bs_worker: export cpu features as flags (for s390)
  * Update kiwi schema to current state
  * Using 15.6 as default OBS server host OS</changelog>
  <changelog author="dleidi@suse.com" date="1740484800">- Update to version 2.10.25
  Bugfixes
  ========
  Frontend:
  * Update rack to version 2.2.11
  - [CVE-2025-25184] Fix possible log Injection in `Rack::CommonLogger`</changelog>
  <changelog author="enavarro@suse.com" date="1741262400">- Update to version 2.10.26
  Bugfixes
  ========
  Frontend:
  * Update rack RubyGem to version 2.2.12
  - Possible Log Injection in Rack::Sendfile (CVE-2025-27111)</changelog>
  <changelog author="enavarro@suse.com" date="1742299200">- Update to version 2.10.27
  Bugfixes
  ========
  Frontend:
  * Update rack RubyGem to version 2.2.13
  - Local file inclusion in Rack::Static (CVE-2025-27610)</changelog>
  <changelog author="enavarro@suse.com" date="1747396800">- Update to version 2.10.28
  Bugfixes
  ========
  Frontend:
  * Update rack RubyGem to version 2.2.14
  - Unbounded parameter parsing in Rack::QueryParser can lead to memory exhaustion (CVE-2025-46727)</changelog>
  <changelog author="enavarro@suse.com" date="1763640000">- Update to version 2.10.29
  Features
  ========
  Backend:
  * Support added for zstd compressed repomd meta data of download on demand repositories
  Bugfixes
  ========
  Frontend:
  * Update rack RubyGem to version 2.2.20
  - Unbounded parameter parsing in Rack::QueryParser can lead to memory exhaustion via semicolon-separated parameters (CVE-2025-59830)
  - Unbounded multipart preamble buffering enables DoS (memory exhaustion) (CVE-2025-61770)
  - Multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion) (CVE-2025-61771)
  - Multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion) (CVE-2025-61772)
  - Improper handling of headers in Rack::Sendfile may allow proxy bypass (CVE-2025-61780)
  - Unbounded read in Rack::Request form parsing can lead to memory exhaustion (CVE-2025-61919)</changelog>
  <changelog author="adrian@suse.de" date="1765972800">- Update to version 2.10.30
  Features
  ========
  Backend:
  * Switch to GPG version 4 signatures for debian repositories</changelog>
  <changelog author="enavarro@suse.com" date="1773144000">- Update to version 2.10.31
  Bugfixes
  ========
  Frontend:
  * Update rack RubyGem to version 2.2.22
  - XSS injection via malicious filename in Rack::Directory (CVE-2026-25500)
  - Directory traversal via root prefix bypass in Rack::Directory (CVE-2026-22860)</changelog>
  <changelog author="adrian@suse.de" date="1777377600">- Update to version 2.10.32
  * Support for Leap-16.0 and SLES-16.0 as server system added
  * Updated perl-BSSolv dependency library</changelog>
</package>
<package pkgid="92f6c40745fcf5d3499f32d55c3e27c9c0dfbdd1a300bc29766b785743de40d0" name="obs-common" arch="noarch">
  <version epoch="0" ver="2.10.31" rel="150600.248.1"/>
  <changelog author="daniel.donisa@suse.com" date="1610452800">- Update to version 2.10.9
  Bugfixes
  ========
  * Frontend:
  - Update redcarpet gem to fix a security vulnerability.</changelog>
  <changelog author="hvogel@suse.com" date="1614254400">- Update to version 2.10.10
  Bugfixes
  ========
  * frontend:
  - CVE-2020-15169:      Potential XSS vulnerability in Action View
  - CVE-2020-8184:       Percent-encoded cookies can be used to overwrite existing
    prefixed cookie names
  - GHSA-g6wq-qcwm-j5g2: ReDoS vulnerability in Sec-WebSocket-Extensions parser
  - GHSA-vr8q-g5c7-m54m: Nokogiri::XML::Schema trusts input by default,
    exposing risk of an XXE vulnerability</changelog>
  <changelog author="hvogel@suse.com" date="1650369600">Update to version 2.10.13
  - Fix XML external entity (XXE) injection in xmlhash
    CVE-2022-21949
  - Update to Ruby 2.7
  - Fix heap memory corruption in yajl-ruby gem
    https://github.com/brianmario/yajl-ruby/security/advisories/GHSA-jj47-x69x-mxrm
  - Fix excessive backtracking in nokogiri gem
    https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-crjr-9rc5-ghw8
  - Fix priviledge escalation issue in ProjectDoProjectReleaseJob (#12407)</changelog>
  <changelog author="adrian@suse.de" date="1651060800">- Update to version 2.10.14
  - support zstd preinstallimages as produced by new build script</changelog>
  <changelog author="lukas.krause@suse.com" date="1651752000">- Update to version 2.10.15
  Bugfixes
  ========
  * Frontend:
  - Fix CVE-2022-22577: There is a possible XSS vulnerability in Rails / Action Pack. CSP headers
    were only sent along with responses that Rails considered as "HTML" responses. This left API
    requests without CSP headers, which could possibly expose users to XSS attacks.
  - Fix CVE-2022-27777: There is a possible XSS vulnerability in Action View tag helpers. Passing
    untrusted input as hash keys can lead to a possible XSS vulnerability</changelog>
  <changelog author="scabrerapadron@suse.de" date="1653566400">- Update to version 2.10.16
  Features
  ========
  Backend:
  * Support for qemu system emulated worker instances
  Bugfixes
  ========
  Frontend:
  * Update Nokogiri to version 1.13.6 to fix two security issues:
  - CVE-2022-29181 Improper Handling of Unexpected Data Type.
  * Update rack to 2.2.3.1
  - CVE-2022-30122 Denial of Service Vulnerability in Rack Multipart Parsing
  - CVE-2022-30123 Possible shell escape sequence injection</changelog>
  <changelog author="daniel.donisa@suse.com" date="1658145600">- Update to version 2.10.17
  Bugfixes
  ========
  Frontend:
  * Bug fix session leaking during BsRequest auto accept
  - See https://github.com/openSUSE/open-build-service/pull/12821
  * Update rails to 5.2.8.1
  - CVE-2022-32224 Possible RCE escalation bug with Serialized Columns in Active Record
  * Update tzinfo from 1.2.9 to 1.2.10
  - CVE-2022-31163 TZInfo relative path traversal vulnerability allows loading of arbitrary files</changelog>
  <changelog author="daniel.donisa@suse.com" date="1671105600">- Update to version 2.10.19
  Bugfixes
  ========
  Frontend:
  * Update rails-html-sanitizer to 1.4.4
  - CVE-2022-32209 Rails::Html::Sanitizer vulnerable to Cross-site Scripting
  * Fix support for qemu system emulated builds via bs_worker</changelog>
  <changelog author="lukas.krause@suse.com" date="1674820800">- Update to version 2.10.20
  Bugfixes
  ========
  Frontend:
  * Update globalid gem from 1.0.0 to 1.0.1
  - Fixes CVE-2023-22799 ReDoS based DoS vulnerability in the GlobalID gem
  * Update rack gem from 2.2.4 to 2.2.6.2
  - Fixes CVE-2022-44571 Denial of service vulnerability in the Content-Disposition parsing
    component of Rack.
  - Fixes CVE-2022-44572 Denial of service vulnerability in the multipart parsing component
    of Rack.
  - Fixes CVE-2022-44570 Possible denial of service vulnerability in the Range header
    parsing component of Rack.</changelog>
  <changelog author="daniel.donisa@suse.com" date="1678968000">- Update to version 2.10.21
  Bugfixes
  ========
  Frontend:
  * Update rack to version 2.2.6.4
  - Fixes CVE-2023-27539 Avoid ReDoS (https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS) in header parsing.
  - Fixes CVE-2023-27530 Possible DoS Vulnerability in Multipart MIME parsing.+</changelog>
  <changelog author="daniel.donisa@suse.com" date="1709294400">- Update to version 2.10.22
  Bugfixes
  ========
  Frontend:
  * Update rack to version 2.2.8.1
  - Fixed ReDoS in Accept header parsing [CVE-2024-26146]
  - Fixed ReDoS in Content Type header parsing [CVE-2024-25126]
  - Reject Range headers which are too large [CVE-2024-26141] DoS Vulnerability in Multipart MIME parsing.</changelog>
  <changelog author="adrian@suse.de" date="1739534400">- Update to version 2.10.24
  * Support usage of scmsync source from remote OBS instances
  * Fix linking of remote backend only packages
  * Handle "manual" source service modes
  * bs_worker: export cpu features as flags (for s390)
  * Update kiwi schema to current state
  * Using 15.6 as default OBS server host OS</changelog>
  <changelog author="dleidi@suse.com" date="1740484800">- Update to version 2.10.25
  Bugfixes
  ========
  Frontend:
  * Update rack to version 2.2.11
  - [CVE-2025-25184] Fix possible log Injection in `Rack::CommonLogger`</changelog>
  <changelog author="enavarro@suse.com" date="1741262400">- Update to version 2.10.26
  Bugfixes
  ========
  Frontend:
  * Update rack RubyGem to version 2.2.12
  - Possible Log Injection in Rack::Sendfile (CVE-2025-27111)</changelog>
  <changelog author="enavarro@suse.com" date="1742299200">- Update to version 2.10.27
  Bugfixes
  ========
  Frontend:
  * Update rack RubyGem to version 2.2.13
  - Local file inclusion in Rack::Static (CVE-2025-27610)</changelog>
  <changelog author="enavarro@suse.com" date="1747396800">- Update to version 2.10.28
  Bugfixes
  ========
  Frontend:
  * Update rack RubyGem to version 2.2.14
  - Unbounded parameter parsing in Rack::QueryParser can lead to memory exhaustion (CVE-2025-46727)</changelog>
  <changelog author="enavarro@suse.com" date="1763640000">- Update to version 2.10.29
  Features
  ========
  Backend:
  * Support added for zstd compressed repomd meta data of download on demand repositories
  Bugfixes
  ========
  Frontend:
  * Update rack RubyGem to version 2.2.20
  - Unbounded parameter parsing in Rack::QueryParser can lead to memory exhaustion via semicolon-separated parameters (CVE-2025-59830)
  - Unbounded multipart preamble buffering enables DoS (memory exhaustion) (CVE-2025-61770)
  - Multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion) (CVE-2025-61771)
  - Multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion) (CVE-2025-61772)
  - Improper handling of headers in Rack::Sendfile may allow proxy bypass (CVE-2025-61780)
  - Unbounded read in Rack::Request form parsing can lead to memory exhaustion (CVE-2025-61919)</changelog>
  <changelog author="adrian@suse.de" date="1765972800">- Update to version 2.10.30
  Features
  ========
  Backend:
  * Switch to GPG version 4 signatures for debian repositories</changelog>
  <changelog author="enavarro@suse.com" date="1773144000">- Update to version 2.10.31
  Bugfixes
  ========
  Frontend:
  * Update rack RubyGem to version 2.2.22
  - XSS injection via malicious filename in Rack::Directory (CVE-2026-25500)
  - Directory traversal via root prefix bypass in Rack::Directory (CVE-2026-22860)</changelog>
  <changelog author="adrian@suse.de" date="1777377600">- Update to version 2.10.32
  * Support for Leap-16.0 and SLES-16.0 as server system added
  * Updated perl-BSSolv dependency library</changelog>
</package>
<package pkgid="0a41c888b123317e4a49b1f3594b3773a4134256a35bc2cb9faa97bec5bd0e05" name="obs-server" arch="noarch">
  <version epoch="0" ver="2.10.31" rel="150600.248.1"/>
  <changelog author="daniel.donisa@suse.com" date="1610452800">- Update to version 2.10.9
  Bugfixes
  ========
  * Frontend:
  - Update redcarpet gem to fix a security vulnerability.</changelog>
  <changelog author="hvogel@suse.com" date="1614254400">- Update to version 2.10.10
  Bugfixes
  ========
  * frontend:
  - CVE-2020-15169:      Potential XSS vulnerability in Action View
  - CVE-2020-8184:       Percent-encoded cookies can be used to overwrite existing
    prefixed cookie names
  - GHSA-g6wq-qcwm-j5g2: ReDoS vulnerability in Sec-WebSocket-Extensions parser
  - GHSA-vr8q-g5c7-m54m: Nokogiri::XML::Schema trusts input by default,
    exposing risk of an XXE vulnerability</changelog>
  <changelog author="hvogel@suse.com" date="1650369600">Update to version 2.10.13
  - Fix XML external entity (XXE) injection in xmlhash
    CVE-2022-21949
  - Update to Ruby 2.7
  - Fix heap memory corruption in yajl-ruby gem
    https://github.com/brianmario/yajl-ruby/security/advisories/GHSA-jj47-x69x-mxrm
  - Fix excessive backtracking in nokogiri gem
    https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-crjr-9rc5-ghw8
  - Fix priviledge escalation issue in ProjectDoProjectReleaseJob (#12407)</changelog>
  <changelog author="adrian@suse.de" date="1651060800">- Update to version 2.10.14
  - support zstd preinstallimages as produced by new build script</changelog>
  <changelog author="lukas.krause@suse.com" date="1651752000">- Update to version 2.10.15
  Bugfixes
  ========
  * Frontend:
  - Fix CVE-2022-22577: There is a possible XSS vulnerability in Rails / Action Pack. CSP headers
    were only sent along with responses that Rails considered as "HTML" responses. This left API
    requests without CSP headers, which could possibly expose users to XSS attacks.
  - Fix CVE-2022-27777: There is a possible XSS vulnerability in Action View tag helpers. Passing
    untrusted input as hash keys can lead to a possible XSS vulnerability</changelog>
  <changelog author="scabrerapadron@suse.de" date="1653566400">- Update to version 2.10.16
  Features
  ========
  Backend:
  * Support for qemu system emulated worker instances
  Bugfixes
  ========
  Frontend:
  * Update Nokogiri to version 1.13.6 to fix two security issues:
  - CVE-2022-29181 Improper Handling of Unexpected Data Type.
  * Update rack to 2.2.3.1
  - CVE-2022-30122 Denial of Service Vulnerability in Rack Multipart Parsing
  - CVE-2022-30123 Possible shell escape sequence injection</changelog>
  <changelog author="daniel.donisa@suse.com" date="1658145600">- Update to version 2.10.17
  Bugfixes
  ========
  Frontend:
  * Bug fix session leaking during BsRequest auto accept
  - See https://github.com/openSUSE/open-build-service/pull/12821
  * Update rails to 5.2.8.1
  - CVE-2022-32224 Possible RCE escalation bug with Serialized Columns in Active Record
  * Update tzinfo from 1.2.9 to 1.2.10
  - CVE-2022-31163 TZInfo relative path traversal vulnerability allows loading of arbitrary files</changelog>
  <changelog author="daniel.donisa@suse.com" date="1671105600">- Update to version 2.10.19
  Bugfixes
  ========
  Frontend:
  * Update rails-html-sanitizer to 1.4.4
  - CVE-2022-32209 Rails::Html::Sanitizer vulnerable to Cross-site Scripting
  * Fix support for qemu system emulated builds via bs_worker</changelog>
  <changelog author="lukas.krause@suse.com" date="1674820800">- Update to version 2.10.20
  Bugfixes
  ========
  Frontend:
  * Update globalid gem from 1.0.0 to 1.0.1
  - Fixes CVE-2023-22799 ReDoS based DoS vulnerability in the GlobalID gem
  * Update rack gem from 2.2.4 to 2.2.6.2
  - Fixes CVE-2022-44571 Denial of service vulnerability in the Content-Disposition parsing
    component of Rack.
  - Fixes CVE-2022-44572 Denial of service vulnerability in the multipart parsing component
    of Rack.
  - Fixes CVE-2022-44570 Possible denial of service vulnerability in the Range header
    parsing component of Rack.</changelog>
  <changelog author="daniel.donisa@suse.com" date="1678968000">- Update to version 2.10.21
  Bugfixes
  ========
  Frontend:
  * Update rack to version 2.2.6.4
  - Fixes CVE-2023-27539 Avoid ReDoS (https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS) in header parsing.
  - Fixes CVE-2023-27530 Possible DoS Vulnerability in Multipart MIME parsing.+</changelog>
  <changelog author="daniel.donisa@suse.com" date="1709294400">- Update to version 2.10.22
  Bugfixes
  ========
  Frontend:
  * Update rack to version 2.2.8.1
  - Fixed ReDoS in Accept header parsing [CVE-2024-26146]
  - Fixed ReDoS in Content Type header parsing [CVE-2024-25126]
  - Reject Range headers which are too large [CVE-2024-26141] DoS Vulnerability in Multipart MIME parsing.</changelog>
  <changelog author="adrian@suse.de" date="1739534400">- Update to version 2.10.24
  * Support usage of scmsync source from remote OBS instances
  * Fix linking of remote backend only packages
  * Handle "manual" source service modes
  * bs_worker: export cpu features as flags (for s390)
  * Update kiwi schema to current state
  * Using 15.6 as default OBS server host OS</changelog>
  <changelog author="dleidi@suse.com" date="1740484800">- Update to version 2.10.25
  Bugfixes
  ========
  Frontend:
  * Update rack to version 2.2.11
  - [CVE-2025-25184] Fix possible log Injection in `Rack::CommonLogger`</changelog>
  <changelog author="enavarro@suse.com" date="1741262400">- Update to version 2.10.26
  Bugfixes
  ========
  Frontend:
  * Update rack RubyGem to version 2.2.12
  - Possible Log Injection in Rack::Sendfile (CVE-2025-27111)</changelog>
  <changelog author="enavarro@suse.com" date="1742299200">- Update to version 2.10.27
  Bugfixes
  ========
  Frontend:
  * Update rack RubyGem to version 2.2.13
  - Local file inclusion in Rack::Static (CVE-2025-27610)</changelog>
  <changelog author="enavarro@suse.com" date="1747396800">- Update to version 2.10.28
  Bugfixes
  ========
  Frontend:
  * Update rack RubyGem to version 2.2.14
  - Unbounded parameter parsing in Rack::QueryParser can lead to memory exhaustion (CVE-2025-46727)</changelog>
  <changelog author="enavarro@suse.com" date="1763640000">- Update to version 2.10.29
  Features
  ========
  Backend:
  * Support added for zstd compressed repomd meta data of download on demand repositories
  Bugfixes
  ========
  Frontend:
  * Update rack RubyGem to version 2.2.20
  - Unbounded parameter parsing in Rack::QueryParser can lead to memory exhaustion via semicolon-separated parameters (CVE-2025-59830)
  - Unbounded multipart preamble buffering enables DoS (memory exhaustion) (CVE-2025-61770)
  - Multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion) (CVE-2025-61771)
  - Multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion) (CVE-2025-61772)
  - Improper handling of headers in Rack::Sendfile may allow proxy bypass (CVE-2025-61780)
  - Unbounded read in Rack::Request form parsing can lead to memory exhaustion (CVE-2025-61919)</changelog>
  <changelog author="adrian@suse.de" date="1765972800">- Update to version 2.10.30
  Features
  ========
  Backend:
  * Switch to GPG version 4 signatures for debian repositories</changelog>
  <changelog author="enavarro@suse.com" date="1773144000">- Update to version 2.10.31
  Bugfixes
  ========
  Frontend:
  * Update rack RubyGem to version 2.2.22
  - XSS injection via malicious filename in Rack::Directory (CVE-2026-25500)
  - Directory traversal via root prefix bypass in Rack::Directory (CVE-2026-22860)</changelog>
  <changelog author="adrian@suse.de" date="1777377600">- Update to version 2.10.32
  * Support for Leap-16.0 and SLES-16.0 as server system added
  * Updated perl-BSSolv dependency library</changelog>
</package>
<package pkgid="67bef27a6bf6c3062355e42a6730cd600a1699987c858c1dc0c88d64b2c3fd5a" name="obs-server" arch="src">
  <version epoch="0" ver="2.10.31" rel="150600.248.1"/>
  <changelog author="daniel.donisa@suse.com" date="1610452800">- Update to version 2.10.9
  Bugfixes
  ========
  * Frontend:
  - Update redcarpet gem to fix a security vulnerability.</changelog>
  <changelog author="hvogel@suse.com" date="1614254400">- Update to version 2.10.10
  Bugfixes
  ========
  * frontend:
  - CVE-2020-15169:      Potential XSS vulnerability in Action View
  - CVE-2020-8184:       Percent-encoded cookies can be used to overwrite existing
    prefixed cookie names
  - GHSA-g6wq-qcwm-j5g2: ReDoS vulnerability in Sec-WebSocket-Extensions parser
  - GHSA-vr8q-g5c7-m54m: Nokogiri::XML::Schema trusts input by default,
    exposing risk of an XXE vulnerability</changelog>
  <changelog author="hvogel@suse.com" date="1650369600">Update to version 2.10.13
  - Fix XML external entity (XXE) injection in xmlhash
    CVE-2022-21949
  - Update to Ruby 2.7
  - Fix heap memory corruption in yajl-ruby gem
    https://github.com/brianmario/yajl-ruby/security/advisories/GHSA-jj47-x69x-mxrm
  - Fix excessive backtracking in nokogiri gem
    https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-crjr-9rc5-ghw8
  - Fix priviledge escalation issue in ProjectDoProjectReleaseJob (#12407)</changelog>
  <changelog author="adrian@suse.de" date="1651060800">- Update to version 2.10.14
  - support zstd preinstallimages as produced by new build script</changelog>
  <changelog author="lukas.krause@suse.com" date="1651752000">- Update to version 2.10.15
  Bugfixes
  ========
  * Frontend:
  - Fix CVE-2022-22577: There is a possible XSS vulnerability in Rails / Action Pack. CSP headers
    were only sent along with responses that Rails considered as "HTML" responses. This left API
    requests without CSP headers, which could possibly expose users to XSS attacks.
  - Fix CVE-2022-27777: There is a possible XSS vulnerability in Action View tag helpers. Passing
    untrusted input as hash keys can lead to a possible XSS vulnerability</changelog>
  <changelog author="scabrerapadron@suse.de" date="1653566400">- Update to version 2.10.16
  Features
  ========
  Backend:
  * Support for qemu system emulated worker instances
  Bugfixes
  ========
  Frontend:
  * Update Nokogiri to version 1.13.6 to fix two security issues:
  - CVE-2022-29181 Improper Handling of Unexpected Data Type.
  * Update rack to 2.2.3.1
  - CVE-2022-30122 Denial of Service Vulnerability in Rack Multipart Parsing
  - CVE-2022-30123 Possible shell escape sequence injection</changelog>
  <changelog author="daniel.donisa@suse.com" date="1658145600">- Update to version 2.10.17
  Bugfixes
  ========
  Frontend:
  * Bug fix session leaking during BsRequest auto accept
  - See https://github.com/openSUSE/open-build-service/pull/12821
  * Update rails to 5.2.8.1
  - CVE-2022-32224 Possible RCE escalation bug with Serialized Columns in Active Record
  * Update tzinfo from 1.2.9 to 1.2.10
  - CVE-2022-31163 TZInfo relative path traversal vulnerability allows loading of arbitrary files</changelog>
  <changelog author="daniel.donisa@suse.com" date="1671105600">- Update to version 2.10.19
  Bugfixes
  ========
  Frontend:
  * Update rails-html-sanitizer to 1.4.4
  - CVE-2022-32209 Rails::Html::Sanitizer vulnerable to Cross-site Scripting
  * Fix support for qemu system emulated builds via bs_worker</changelog>
  <changelog author="lukas.krause@suse.com" date="1674820800">- Update to version 2.10.20
  Bugfixes
  ========
  Frontend:
  * Update globalid gem from 1.0.0 to 1.0.1
  - Fixes CVE-2023-22799 ReDoS based DoS vulnerability in the GlobalID gem
  * Update rack gem from 2.2.4 to 2.2.6.2
  - Fixes CVE-2022-44571 Denial of service vulnerability in the Content-Disposition parsing
    component of Rack.
  - Fixes CVE-2022-44572 Denial of service vulnerability in the multipart parsing component
    of Rack.
  - Fixes CVE-2022-44570 Possible denial of service vulnerability in the Range header
    parsing component of Rack.</changelog>
  <changelog author="daniel.donisa@suse.com" date="1678968000">- Update to version 2.10.21
  Bugfixes
  ========
  Frontend:
  * Update rack to version 2.2.6.4
  - Fixes CVE-2023-27539 Avoid ReDoS (https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS) in header parsing.
  - Fixes CVE-2023-27530 Possible DoS Vulnerability in Multipart MIME parsing.+</changelog>
  <changelog author="daniel.donisa@suse.com" date="1709294400">- Update to version 2.10.22
  Bugfixes
  ========
  Frontend:
  * Update rack to version 2.2.8.1
  - Fixed ReDoS in Accept header parsing [CVE-2024-26146]
  - Fixed ReDoS in Content Type header parsing [CVE-2024-25126]
  - Reject Range headers which are too large [CVE-2024-26141] DoS Vulnerability in Multipart MIME parsing.</changelog>
  <changelog author="adrian@suse.de" date="1739534400">- Update to version 2.10.24
  * Support usage of scmsync source from remote OBS instances
  * Fix linking of remote backend only packages
  * Handle "manual" source service modes
  * bs_worker: export cpu features as flags (for s390)
  * Update kiwi schema to current state
  * Using 15.6 as default OBS server host OS</changelog>
  <changelog author="dleidi@suse.com" date="1740484800">- Update to version 2.10.25
  Bugfixes
  ========
  Frontend:
  * Update rack to version 2.2.11
  - [CVE-2025-25184] Fix possible log Injection in `Rack::CommonLogger`</changelog>
  <changelog author="enavarro@suse.com" date="1741262400">- Update to version 2.10.26
  Bugfixes
  ========
  Frontend:
  * Update rack RubyGem to version 2.2.12
  - Possible Log Injection in Rack::Sendfile (CVE-2025-27111)</changelog>
  <changelog author="enavarro@suse.com" date="1742299200">- Update to version 2.10.27
  Bugfixes
  ========
  Frontend:
  * Update rack RubyGem to version 2.2.13
  - Local file inclusion in Rack::Static (CVE-2025-27610)</changelog>
  <changelog author="enavarro@suse.com" date="1747396800">- Update to version 2.10.28
  Bugfixes
  ========
  Frontend:
  * Update rack RubyGem to version 2.2.14
  - Unbounded parameter parsing in Rack::QueryParser can lead to memory exhaustion (CVE-2025-46727)</changelog>
  <changelog author="enavarro@suse.com" date="1763640000">- Update to version 2.10.29
  Features
  ========
  Backend:
  * Support added for zstd compressed repomd meta data of download on demand repositories
  Bugfixes
  ========
  Frontend:
  * Update rack RubyGem to version 2.2.20
  - Unbounded parameter parsing in Rack::QueryParser can lead to memory exhaustion via semicolon-separated parameters (CVE-2025-59830)
  - Unbounded multipart preamble buffering enables DoS (memory exhaustion) (CVE-2025-61770)
  - Multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion) (CVE-2025-61771)
  - Multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion) (CVE-2025-61772)
  - Improper handling of headers in Rack::Sendfile may allow proxy bypass (CVE-2025-61780)
  - Unbounded read in Rack::Request form parsing can lead to memory exhaustion (CVE-2025-61919)</changelog>
  <changelog author="adrian@suse.de" date="1765972800">- Update to version 2.10.30
  Features
  ========
  Backend:
  * Switch to GPG version 4 signatures for debian repositories</changelog>
  <changelog author="enavarro@suse.com" date="1773144000">- Update to version 2.10.31
  Bugfixes
  ========
  Frontend:
  * Update rack RubyGem to version 2.2.22
  - XSS injection via malicious filename in Rack::Directory (CVE-2026-25500)
  - Directory traversal via root prefix bypass in Rack::Directory (CVE-2026-22860)</changelog>
  <changelog author="adrian@suse.de" date="1777377600">- Update to version 2.10.32
  * Support for Leap-16.0 and SLES-16.0 as server system added
  * Updated perl-BSSolv dependency library</changelog>
</package>
<package pkgid="4cda403ed3ffdbeff1d6ac950f5c2e4362f28d8068c1def22d46d7fcddebfd5f" name="obs-tests-appliance" arch="noarch">
  <version epoch="0" ver="2.10.31" rel="150600.248.1"/>
  <changelog author="daniel.donisa@suse.com" date="1610452800">- Update to version 2.10.9
  Bugfixes
  ========
  * Frontend:
  - Update redcarpet gem to fix a security vulnerability.</changelog>
  <changelog author="hvogel@suse.com" date="1614254400">- Update to version 2.10.10
  Bugfixes
  ========
  * frontend:
  - CVE-2020-15169:      Potential XSS vulnerability in Action View
  - CVE-2020-8184:       Percent-encoded cookies can be used to overwrite existing
    prefixed cookie names
  - GHSA-g6wq-qcwm-j5g2: ReDoS vulnerability in Sec-WebSocket-Extensions parser
  - GHSA-vr8q-g5c7-m54m: Nokogiri::XML::Schema trusts input by default,
    exposing risk of an XXE vulnerability</changelog>
  <changelog author="hvogel@suse.com" date="1650369600">Update to version 2.10.13
  - Fix XML external entity (XXE) injection in xmlhash
    CVE-2022-21949
  - Update to Ruby 2.7
  - Fix heap memory corruption in yajl-ruby gem
    https://github.com/brianmario/yajl-ruby/security/advisories/GHSA-jj47-x69x-mxrm
  - Fix excessive backtracking in nokogiri gem
    https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-crjr-9rc5-ghw8
  - Fix priviledge escalation issue in ProjectDoProjectReleaseJob (#12407)</changelog>
  <changelog author="adrian@suse.de" date="1651060800">- Update to version 2.10.14
  - support zstd preinstallimages as produced by new build script</changelog>
  <changelog author="lukas.krause@suse.com" date="1651752000">- Update to version 2.10.15
  Bugfixes
  ========
  * Frontend:
  - Fix CVE-2022-22577: There is a possible XSS vulnerability in Rails / Action Pack. CSP headers
    were only sent along with responses that Rails considered as "HTML" responses. This left API
    requests without CSP headers, which could possibly expose users to XSS attacks.
  - Fix CVE-2022-27777: There is a possible XSS vulnerability in Action View tag helpers. Passing
    untrusted input as hash keys can lead to a possible XSS vulnerability</changelog>
  <changelog author="scabrerapadron@suse.de" date="1653566400">- Update to version 2.10.16
  Features
  ========
  Backend:
  * Support for qemu system emulated worker instances
  Bugfixes
  ========
  Frontend:
  * Update Nokogiri to version 1.13.6 to fix two security issues:
  - CVE-2022-29181 Improper Handling of Unexpected Data Type.
  * Update rack to 2.2.3.1
  - CVE-2022-30122 Denial of Service Vulnerability in Rack Multipart Parsing
  - CVE-2022-30123 Possible shell escape sequence injection</changelog>
  <changelog author="daniel.donisa@suse.com" date="1658145600">- Update to version 2.10.17
  Bugfixes
  ========
  Frontend:
  * Bug fix session leaking during BsRequest auto accept
  - See https://github.com/openSUSE/open-build-service/pull/12821
  * Update rails to 5.2.8.1
  - CVE-2022-32224 Possible RCE escalation bug with Serialized Columns in Active Record
  * Update tzinfo from 1.2.9 to 1.2.10
  - CVE-2022-31163 TZInfo relative path traversal vulnerability allows loading of arbitrary files</changelog>
  <changelog author="daniel.donisa@suse.com" date="1671105600">- Update to version 2.10.19
  Bugfixes
  ========
  Frontend:
  * Update rails-html-sanitizer to 1.4.4
  - CVE-2022-32209 Rails::Html::Sanitizer vulnerable to Cross-site Scripting
  * Fix support for qemu system emulated builds via bs_worker</changelog>
  <changelog author="lukas.krause@suse.com" date="1674820800">- Update to version 2.10.20
  Bugfixes
  ========
  Frontend:
  * Update globalid gem from 1.0.0 to 1.0.1
  - Fixes CVE-2023-22799 ReDoS based DoS vulnerability in the GlobalID gem
  * Update rack gem from 2.2.4 to 2.2.6.2
  - Fixes CVE-2022-44571 Denial of service vulnerability in the Content-Disposition parsing
    component of Rack.
  - Fixes CVE-2022-44572 Denial of service vulnerability in the multipart parsing component
    of Rack.
  - Fixes CVE-2022-44570 Possible denial of service vulnerability in the Range header
    parsing component of Rack.</changelog>
  <changelog author="daniel.donisa@suse.com" date="1678968000">- Update to version 2.10.21
  Bugfixes
  ========
  Frontend:
  * Update rack to version 2.2.6.4
  - Fixes CVE-2023-27539 Avoid ReDoS (https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS) in header parsing.
  - Fixes CVE-2023-27530 Possible DoS Vulnerability in Multipart MIME parsing.+</changelog>
  <changelog author="daniel.donisa@suse.com" date="1709294400">- Update to version 2.10.22
  Bugfixes
  ========
  Frontend:
  * Update rack to version 2.2.8.1
  - Fixed ReDoS in Accept header parsing [CVE-2024-26146]
  - Fixed ReDoS in Content Type header parsing [CVE-2024-25126]
  - Reject Range headers which are too large [CVE-2024-26141] DoS Vulnerability in Multipart MIME parsing.</changelog>
  <changelog author="adrian@suse.de" date="1739534400">- Update to version 2.10.24
  * Support usage of scmsync source from remote OBS instances
  * Fix linking of remote backend only packages
  * Handle "manual" source service modes
  * bs_worker: export cpu features as flags (for s390)
  * Update kiwi schema to current state
  * Using 15.6 as default OBS server host OS</changelog>
  <changelog author="dleidi@suse.com" date="1740484800">- Update to version 2.10.25
  Bugfixes
  ========
  Frontend:
  * Update rack to version 2.2.11
  - [CVE-2025-25184] Fix possible log Injection in `Rack::CommonLogger`</changelog>
  <changelog author="enavarro@suse.com" date="1741262400">- Update to version 2.10.26
  Bugfixes
  ========
  Frontend:
  * Update rack RubyGem to version 2.2.12
  - Possible Log Injection in Rack::Sendfile (CVE-2025-27111)</changelog>
  <changelog author="enavarro@suse.com" date="1742299200">- Update to version 2.10.27
  Bugfixes
  ========
  Frontend:
  * Update rack RubyGem to version 2.2.13
  - Local file inclusion in Rack::Static (CVE-2025-27610)</changelog>
  <changelog author="enavarro@suse.com" date="1747396800">- Update to version 2.10.28
  Bugfixes
  ========
  Frontend:
  * Update rack RubyGem to version 2.2.14
  - Unbounded parameter parsing in Rack::QueryParser can lead to memory exhaustion (CVE-2025-46727)</changelog>
  <changelog author="enavarro@suse.com" date="1763640000">- Update to version 2.10.29
  Features
  ========
  Backend:
  * Support added for zstd compressed repomd meta data of download on demand repositories
  Bugfixes
  ========
  Frontend:
  * Update rack RubyGem to version 2.2.20
  - Unbounded parameter parsing in Rack::QueryParser can lead to memory exhaustion via semicolon-separated parameters (CVE-2025-59830)
  - Unbounded multipart preamble buffering enables DoS (memory exhaustion) (CVE-2025-61770)
  - Multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion) (CVE-2025-61771)
  - Multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion) (CVE-2025-61772)
  - Improper handling of headers in Rack::Sendfile may allow proxy bypass (CVE-2025-61780)
  - Unbounded read in Rack::Request form parsing can lead to memory exhaustion (CVE-2025-61919)</changelog>
  <changelog author="adrian@suse.de" date="1765972800">- Update to version 2.10.30
  Features
  ========
  Backend:
  * Switch to GPG version 4 signatures for debian repositories</changelog>
  <changelog author="enavarro@suse.com" date="1773144000">- Update to version 2.10.31
  Bugfixes
  ========
  Frontend:
  * Update rack RubyGem to version 2.2.22
  - XSS injection via malicious filename in Rack::Directory (CVE-2026-25500)
  - Directory traversal via root prefix bypass in Rack::Directory (CVE-2026-22860)</changelog>
  <changelog author="adrian@suse.de" date="1777377600">- Update to version 2.10.32
  * Support for Leap-16.0 and SLES-16.0 as server system added
  * Updated perl-BSSolv dependency library</changelog>
</package>
<package pkgid="cb7f7eab0cfd9cb2c1aec466aec813cf4a809f6f2530db9ca5c17a43edb3b137" name="obs-utils" arch="noarch">
  <version epoch="0" ver="2.10.31" rel="150600.248.1"/>
  <changelog author="daniel.donisa@suse.com" date="1610452800">- Update to version 2.10.9
  Bugfixes
  ========
  * Frontend:
  - Update redcarpet gem to fix a security vulnerability.</changelog>
  <changelog author="hvogel@suse.com" date="1614254400">- Update to version 2.10.10
  Bugfixes
  ========
  * frontend:
  - CVE-2020-15169:      Potential XSS vulnerability in Action View
  - CVE-2020-8184:       Percent-encoded cookies can be used to overwrite existing
    prefixed cookie names
  - GHSA-g6wq-qcwm-j5g2: ReDoS vulnerability in Sec-WebSocket-Extensions parser
  - GHSA-vr8q-g5c7-m54m: Nokogiri::XML::Schema trusts input by default,
    exposing risk of an XXE vulnerability</changelog>
  <changelog author="hvogel@suse.com" date="1650369600">Update to version 2.10.13
  - Fix XML external entity (XXE) injection in xmlhash
    CVE-2022-21949
  - Update to Ruby 2.7
  - Fix heap memory corruption in yajl-ruby gem
    https://github.com/brianmario/yajl-ruby/security/advisories/GHSA-jj47-x69x-mxrm
  - Fix excessive backtracking in nokogiri gem
    https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-crjr-9rc5-ghw8
  - Fix priviledge escalation issue in ProjectDoProjectReleaseJob (#12407)</changelog>
  <changelog author="adrian@suse.de" date="1651060800">- Update to version 2.10.14
  - support zstd preinstallimages as produced by new build script</changelog>
  <changelog author="lukas.krause@suse.com" date="1651752000">- Update to version 2.10.15
  Bugfixes
  ========
  * Frontend:
  - Fix CVE-2022-22577: There is a possible XSS vulnerability in Rails / Action Pack. CSP headers
    were only sent along with responses that Rails considered as "HTML" responses. This left API
    requests without CSP headers, which could possibly expose users to XSS attacks.
  - Fix CVE-2022-27777: There is a possible XSS vulnerability in Action View tag helpers. Passing
    untrusted input as hash keys can lead to a possible XSS vulnerability</changelog>
  <changelog author="scabrerapadron@suse.de" date="1653566400">- Update to version 2.10.16
  Features
  ========
  Backend:
  * Support for qemu system emulated worker instances
  Bugfixes
  ========
  Frontend:
  * Update Nokogiri to version 1.13.6 to fix two security issues:
  - CVE-2022-29181 Improper Handling of Unexpected Data Type.
  * Update rack to 2.2.3.1
  - CVE-2022-30122 Denial of Service Vulnerability in Rack Multipart Parsing
  - CVE-2022-30123 Possible shell escape sequence injection</changelog>
  <changelog author="daniel.donisa@suse.com" date="1658145600">- Update to version 2.10.17
  Bugfixes
  ========
  Frontend:
  * Bug fix session leaking during BsRequest auto accept
  - See https://github.com/openSUSE/open-build-service/pull/12821
  * Update rails to 5.2.8.1
  - CVE-2022-32224 Possible RCE escalation bug with Serialized Columns in Active Record
  * Update tzinfo from 1.2.9 to 1.2.10
  - CVE-2022-31163 TZInfo relative path traversal vulnerability allows loading of arbitrary files</changelog>
  <changelog author="daniel.donisa@suse.com" date="1671105600">- Update to version 2.10.19
  Bugfixes
  ========
  Frontend:
  * Update rails-html-sanitizer to 1.4.4
  - CVE-2022-32209 Rails::Html::Sanitizer vulnerable to Cross-site Scripting
  * Fix support for qemu system emulated builds via bs_worker</changelog>
  <changelog author="lukas.krause@suse.com" date="1674820800">- Update to version 2.10.20
  Bugfixes
  ========
  Frontend:
  * Update globalid gem from 1.0.0 to 1.0.1
  - Fixes CVE-2023-22799 ReDoS based DoS vulnerability in the GlobalID gem
  * Update rack gem from 2.2.4 to 2.2.6.2
  - Fixes CVE-2022-44571 Denial of service vulnerability in the Content-Disposition parsing
    component of Rack.
  - Fixes CVE-2022-44572 Denial of service vulnerability in the multipart parsing component
    of Rack.
  - Fixes CVE-2022-44570 Possible denial of service vulnerability in the Range header
    parsing component of Rack.</changelog>
  <changelog author="daniel.donisa@suse.com" date="1678968000">- Update to version 2.10.21
  Bugfixes
  ========
  Frontend:
  * Update rack to version 2.2.6.4
  - Fixes CVE-2023-27539 Avoid ReDoS (https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS) in header parsing.
  - Fixes CVE-2023-27530 Possible DoS Vulnerability in Multipart MIME parsing.+</changelog>
  <changelog author="daniel.donisa@suse.com" date="1709294400">- Update to version 2.10.22
  Bugfixes
  ========
  Frontend:
  * Update rack to version 2.2.8.1
  - Fixed ReDoS in Accept header parsing [CVE-2024-26146]
  - Fixed ReDoS in Content Type header parsing [CVE-2024-25126]
  - Reject Range headers which are too large [CVE-2024-26141] DoS Vulnerability in Multipart MIME parsing.</changelog>
  <changelog author="adrian@suse.de" date="1739534400">- Update to version 2.10.24
  * Support usage of scmsync source from remote OBS instances
  * Fix linking of remote backend only packages
  * Handle "manual" source service modes
  * bs_worker: export cpu features as flags (for s390)
  * Update kiwi schema to current state
  * Using 15.6 as default OBS server host OS</changelog>
  <changelog author="dleidi@suse.com" date="1740484800">- Update to version 2.10.25
  Bugfixes
  ========
  Frontend:
  * Update rack to version 2.2.11
  - [CVE-2025-25184] Fix possible log Injection in `Rack::CommonLogger`</changelog>
  <changelog author="enavarro@suse.com" date="1741262400">- Update to version 2.10.26
  Bugfixes
  ========
  Frontend:
  * Update rack RubyGem to version 2.2.12
  - Possible Log Injection in Rack::Sendfile (CVE-2025-27111)</changelog>
  <changelog author="enavarro@suse.com" date="1742299200">- Update to version 2.10.27
  Bugfixes
  ========
  Frontend:
  * Update rack RubyGem to version 2.2.13
  - Local file inclusion in Rack::Static (CVE-2025-27610)</changelog>
  <changelog author="enavarro@suse.com" date="1747396800">- Update to version 2.10.28
  Bugfixes
  ========
  Frontend:
  * Update rack RubyGem to version 2.2.14
  - Unbounded parameter parsing in Rack::QueryParser can lead to memory exhaustion (CVE-2025-46727)</changelog>
  <changelog author="enavarro@suse.com" date="1763640000">- Update to version 2.10.29
  Features
  ========
  Backend:
  * Support added for zstd compressed repomd meta data of download on demand repositories
  Bugfixes
  ========
  Frontend:
  * Update rack RubyGem to version 2.2.20
  - Unbounded parameter parsing in Rack::QueryParser can lead to memory exhaustion via semicolon-separated parameters (CVE-2025-59830)
  - Unbounded multipart preamble buffering enables DoS (memory exhaustion) (CVE-2025-61770)
  - Multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion) (CVE-2025-61771)
  - Multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion) (CVE-2025-61772)
  - Improper handling of headers in Rack::Sendfile may allow proxy bypass (CVE-2025-61780)
  - Unbounded read in Rack::Request form parsing can lead to memory exhaustion (CVE-2025-61919)</changelog>
  <changelog author="adrian@suse.de" date="1765972800">- Update to version 2.10.30
  Features
  ========
  Backend:
  * Switch to GPG version 4 signatures for debian repositories</changelog>
  <changelog author="enavarro@suse.com" date="1773144000">- Update to version 2.10.31
  Bugfixes
  ========
  Frontend:
  * Update rack RubyGem to version 2.2.22
  - XSS injection via malicious filename in Rack::Directory (CVE-2026-25500)
  - Directory traversal via root prefix bypass in Rack::Directory (CVE-2026-22860)</changelog>
  <changelog author="adrian@suse.de" date="1777377600">- Update to version 2.10.32
  * Support for Leap-16.0 and SLES-16.0 as server system added
  * Updated perl-BSSolv dependency library</changelog>
</package>
<package pkgid="50f3af2f20920302220112719cf0eeac5491366c3e4ad95a756fd670720c3f45" name="obs-worker" arch="noarch">
  <version epoch="0" ver="2.10.31" rel="150600.248.1"/>
  <changelog author="daniel.donisa@suse.com" date="1610452800">- Update to version 2.10.9
  Bugfixes
  ========
  * Frontend:
  - Update redcarpet gem to fix a security vulnerability.</changelog>
  <changelog author="hvogel@suse.com" date="1614254400">- Update to version 2.10.10
  Bugfixes
  ========
  * frontend:
  - CVE-2020-15169:      Potential XSS vulnerability in Action View
  - CVE-2020-8184:       Percent-encoded cookies can be used to overwrite existing
    prefixed cookie names
  - GHSA-g6wq-qcwm-j5g2: ReDoS vulnerability in Sec-WebSocket-Extensions parser
  - GHSA-vr8q-g5c7-m54m: Nokogiri::XML::Schema trusts input by default,
    exposing risk of an XXE vulnerability</changelog>
  <changelog author="hvogel@suse.com" date="1650369600">Update to version 2.10.13
  - Fix XML external entity (XXE) injection in xmlhash
    CVE-2022-21949
  - Update to Ruby 2.7
  - Fix heap memory corruption in yajl-ruby gem
    https://github.com/brianmario/yajl-ruby/security/advisories/GHSA-jj47-x69x-mxrm
  - Fix excessive backtracking in nokogiri gem
    https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-crjr-9rc5-ghw8
  - Fix priviledge escalation issue in ProjectDoProjectReleaseJob (#12407)</changelog>
  <changelog author="adrian@suse.de" date="1651060800">- Update to version 2.10.14
  - support zstd preinstallimages as produced by new build script</changelog>
  <changelog author="lukas.krause@suse.com" date="1651752000">- Update to version 2.10.15
  Bugfixes
  ========
  * Frontend:
  - Fix CVE-2022-22577: There is a possible XSS vulnerability in Rails / Action Pack. CSP headers
    were only sent along with responses that Rails considered as "HTML" responses. This left API
    requests without CSP headers, which could possibly expose users to XSS attacks.
  - Fix CVE-2022-27777: There is a possible XSS vulnerability in Action View tag helpers. Passing
    untrusted input as hash keys can lead to a possible XSS vulnerability</changelog>
  <changelog author="scabrerapadron@suse.de" date="1653566400">- Update to version 2.10.16
  Features
  ========
  Backend:
  * Support for qemu system emulated worker instances
  Bugfixes
  ========
  Frontend:
  * Update Nokogiri to version 1.13.6 to fix two security issues:
  - CVE-2022-29181 Improper Handling of Unexpected Data Type.
  * Update rack to 2.2.3.1
  - CVE-2022-30122 Denial of Service Vulnerability in Rack Multipart Parsing
  - CVE-2022-30123 Possible shell escape sequence injection</changelog>
  <changelog author="daniel.donisa@suse.com" date="1658145600">- Update to version 2.10.17
  Bugfixes
  ========
  Frontend:
  * Bug fix session leaking during BsRequest auto accept
  - See https://github.com/openSUSE/open-build-service/pull/12821
  * Update rails to 5.2.8.1
  - CVE-2022-32224 Possible RCE escalation bug with Serialized Columns in Active Record
  * Update tzinfo from 1.2.9 to 1.2.10
  - CVE-2022-31163 TZInfo relative path traversal vulnerability allows loading of arbitrary files</changelog>
  <changelog author="daniel.donisa@suse.com" date="1671105600">- Update to version 2.10.19
  Bugfixes
  ========
  Frontend:
  * Update rails-html-sanitizer to 1.4.4
  - CVE-2022-32209 Rails::Html::Sanitizer vulnerable to Cross-site Scripting
  * Fix support for qemu system emulated builds via bs_worker</changelog>
  <changelog author="lukas.krause@suse.com" date="1674820800">- Update to version 2.10.20
  Bugfixes
  ========
  Frontend:
  * Update globalid gem from 1.0.0 to 1.0.1
  - Fixes CVE-2023-22799 ReDoS based DoS vulnerability in the GlobalID gem
  * Update rack gem from 2.2.4 to 2.2.6.2
  - Fixes CVE-2022-44571 Denial of service vulnerability in the Content-Disposition parsing
    component of Rack.
  - Fixes CVE-2022-44572 Denial of service vulnerability in the multipart parsing component
    of Rack.
  - Fixes CVE-2022-44570 Possible denial of service vulnerability in the Range header
    parsing component of Rack.</changelog>
  <changelog author="daniel.donisa@suse.com" date="1678968000">- Update to version 2.10.21
  Bugfixes
  ========
  Frontend:
  * Update rack to version 2.2.6.4
  - Fixes CVE-2023-27539 Avoid ReDoS (https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS) in header parsing.
  - Fixes CVE-2023-27530 Possible DoS Vulnerability in Multipart MIME parsing.+</changelog>
  <changelog author="daniel.donisa@suse.com" date="1709294400">- Update to version 2.10.22
  Bugfixes
  ========
  Frontend:
  * Update rack to version 2.2.8.1
  - Fixed ReDoS in Accept header parsing [CVE-2024-26146]
  - Fixed ReDoS in Content Type header parsing [CVE-2024-25126]
  - Reject Range headers which are too large [CVE-2024-26141] DoS Vulnerability in Multipart MIME parsing.</changelog>
  <changelog author="adrian@suse.de" date="1739534400">- Update to version 2.10.24
  * Support usage of scmsync source from remote OBS instances
  * Fix linking of remote backend only packages
  * Handle "manual" source service modes
  * bs_worker: export cpu features as flags (for s390)
  * Update kiwi schema to current state
  * Using 15.6 as default OBS server host OS</changelog>
  <changelog author="dleidi@suse.com" date="1740484800">- Update to version 2.10.25
  Bugfixes
  ========
  Frontend:
  * Update rack to version 2.2.11
  - [CVE-2025-25184] Fix possible log Injection in `Rack::CommonLogger`</changelog>
  <changelog author="enavarro@suse.com" date="1741262400">- Update to version 2.10.26
  Bugfixes
  ========
  Frontend:
  * Update rack RubyGem to version 2.2.12
  - Possible Log Injection in Rack::Sendfile (CVE-2025-27111)</changelog>
  <changelog author="enavarro@suse.com" date="1742299200">- Update to version 2.10.27
  Bugfixes
  ========
  Frontend:
  * Update rack RubyGem to version 2.2.13
  - Local file inclusion in Rack::Static (CVE-2025-27610)</changelog>
  <changelog author="enavarro@suse.com" date="1747396800">- Update to version 2.10.28
  Bugfixes
  ========
  Frontend:
  * Update rack RubyGem to version 2.2.14
  - Unbounded parameter parsing in Rack::QueryParser can lead to memory exhaustion (CVE-2025-46727)</changelog>
  <changelog author="enavarro@suse.com" date="1763640000">- Update to version 2.10.29
  Features
  ========
  Backend:
  * Support added for zstd compressed repomd meta data of download on demand repositories
  Bugfixes
  ========
  Frontend:
  * Update rack RubyGem to version 2.2.20
  - Unbounded parameter parsing in Rack::QueryParser can lead to memory exhaustion via semicolon-separated parameters (CVE-2025-59830)
  - Unbounded multipart preamble buffering enables DoS (memory exhaustion) (CVE-2025-61770)
  - Multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion) (CVE-2025-61771)
  - Multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion) (CVE-2025-61772)
  - Improper handling of headers in Rack::Sendfile may allow proxy bypass (CVE-2025-61780)
  - Unbounded read in Rack::Request form parsing can lead to memory exhaustion (CVE-2025-61919)</changelog>
  <changelog author="adrian@suse.de" date="1765972800">- Update to version 2.10.30
  Features
  ========
  Backend:
  * Switch to GPG version 4 signatures for debian repositories</changelog>
  <changelog author="enavarro@suse.com" date="1773144000">- Update to version 2.10.31
  Bugfixes
  ========
  Frontend:
  * Update rack RubyGem to version 2.2.22
  - XSS injection via malicious filename in Rack::Directory (CVE-2026-25500)
  - Directory traversal via root prefix bypass in Rack::Directory (CVE-2026-22860)</changelog>
  <changelog author="adrian@suse.de" date="1777377600">- Update to version 2.10.32
  * Support for Leap-16.0 and SLES-16.0 as server system added
  * Updated perl-BSSolv dependency library</changelog>
</package>
<package pkgid="f6216ab6c582cfeceab54c576773eb20c71b3b93de12af6aa3786c2a464650ef" name="system-user-obsapidelayed" arch="noarch">
  <version epoch="0" ver="2.10.31" rel="150600.248.1"/>
  <changelog author="daniel.donisa@suse.com" date="1610452800">- Update to version 2.10.9
  Bugfixes
  ========
  * Frontend:
  - Update redcarpet gem to fix a security vulnerability.</changelog>
  <changelog author="hvogel@suse.com" date="1614254400">- Update to version 2.10.10
  Bugfixes
  ========
  * frontend:
  - CVE-2020-15169:      Potential XSS vulnerability in Action View
  - CVE-2020-8184:       Percent-encoded cookies can be used to overwrite existing
    prefixed cookie names
  - GHSA-g6wq-qcwm-j5g2: ReDoS vulnerability in Sec-WebSocket-Extensions parser
  - GHSA-vr8q-g5c7-m54m: Nokogiri::XML::Schema trusts input by default,
    exposing risk of an XXE vulnerability</changelog>
  <changelog author="hvogel@suse.com" date="1650369600">Update to version 2.10.13
  - Fix XML external entity (XXE) injection in xmlhash
    CVE-2022-21949
  - Update to Ruby 2.7
  - Fix heap memory corruption in yajl-ruby gem
    https://github.com/brianmario/yajl-ruby/security/advisories/GHSA-jj47-x69x-mxrm
  - Fix excessive backtracking in nokogiri gem
    https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-crjr-9rc5-ghw8
  - Fix priviledge escalation issue in ProjectDoProjectReleaseJob (#12407)</changelog>
  <changelog author="adrian@suse.de" date="1651060800">- Update to version 2.10.14
  - support zstd preinstallimages as produced by new build script</changelog>
  <changelog author="lukas.krause@suse.com" date="1651752000">- Update to version 2.10.15
  Bugfixes
  ========
  * Frontend:
  - Fix CVE-2022-22577: There is a possible XSS vulnerability in Rails / Action Pack. CSP headers
    were only sent along with responses that Rails considered as "HTML" responses. This left API
    requests without CSP headers, which could possibly expose users to XSS attacks.
  - Fix CVE-2022-27777: There is a possible XSS vulnerability in Action View tag helpers. Passing
    untrusted input as hash keys can lead to a possible XSS vulnerability</changelog>
  <changelog author="scabrerapadron@suse.de" date="1653566400">- Update to version 2.10.16
  Features
  ========
  Backend:
  * Support for qemu system emulated worker instances
  Bugfixes
  ========
  Frontend:
  * Update Nokogiri to version 1.13.6 to fix two security issues:
  - CVE-2022-29181 Improper Handling of Unexpected Data Type.
  * Update rack to 2.2.3.1
  - CVE-2022-30122 Denial of Service Vulnerability in Rack Multipart Parsing
  - CVE-2022-30123 Possible shell escape sequence injection</changelog>
  <changelog author="daniel.donisa@suse.com" date="1658145600">- Update to version 2.10.17
  Bugfixes
  ========
  Frontend:
  * Bug fix session leaking during BsRequest auto accept
  - See https://github.com/openSUSE/open-build-service/pull/12821
  * Update rails to 5.2.8.1
  - CVE-2022-32224 Possible RCE escalation bug with Serialized Columns in Active Record
  * Update tzinfo from 1.2.9 to 1.2.10
  - CVE-2022-31163 TZInfo relative path traversal vulnerability allows loading of arbitrary files</changelog>
  <changelog author="daniel.donisa@suse.com" date="1671105600">- Update to version 2.10.19
  Bugfixes
  ========
  Frontend:
  * Update rails-html-sanitizer to 1.4.4
  - CVE-2022-32209 Rails::Html::Sanitizer vulnerable to Cross-site Scripting
  * Fix support for qemu system emulated builds via bs_worker</changelog>
  <changelog author="lukas.krause@suse.com" date="1674820800">- Update to version 2.10.20
  Bugfixes
  ========
  Frontend:
  * Update globalid gem from 1.0.0 to 1.0.1
  - Fixes CVE-2023-22799 ReDoS based DoS vulnerability in the GlobalID gem
  * Update rack gem from 2.2.4 to 2.2.6.2
  - Fixes CVE-2022-44571 Denial of service vulnerability in the Content-Disposition parsing
    component of Rack.
  - Fixes CVE-2022-44572 Denial of service vulnerability in the multipart parsing component
    of Rack.
  - Fixes CVE-2022-44570 Possible denial of service vulnerability in the Range header
    parsing component of Rack.</changelog>
  <changelog author="daniel.donisa@suse.com" date="1678968000">- Update to version 2.10.21
  Bugfixes
  ========
  Frontend:
  * Update rack to version 2.2.6.4
  - Fixes CVE-2023-27539 Avoid ReDoS (https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS) in header parsing.
  - Fixes CVE-2023-27530 Possible DoS Vulnerability in Multipart MIME parsing.+</changelog>
  <changelog author="daniel.donisa@suse.com" date="1709294400">- Update to version 2.10.22
  Bugfixes
  ========
  Frontend:
  * Update rack to version 2.2.8.1
  - Fixed ReDoS in Accept header parsing [CVE-2024-26146]
  - Fixed ReDoS in Content Type header parsing [CVE-2024-25126]
  - Reject Range headers which are too large [CVE-2024-26141] DoS Vulnerability in Multipart MIME parsing.</changelog>
  <changelog author="adrian@suse.de" date="1739534400">- Update to version 2.10.24
  * Support usage of scmsync source from remote OBS instances
  * Fix linking of remote backend only packages
  * Handle "manual" source service modes
  * bs_worker: export cpu features as flags (for s390)
  * Update kiwi schema to current state
  * Using 15.6 as default OBS server host OS</changelog>
  <changelog author="dleidi@suse.com" date="1740484800">- Update to version 2.10.25
  Bugfixes
  ========
  Frontend:
  * Update rack to version 2.2.11
  - [CVE-2025-25184] Fix possible log Injection in `Rack::CommonLogger`</changelog>
  <changelog author="enavarro@suse.com" date="1741262400">- Update to version 2.10.26
  Bugfixes
  ========
  Frontend:
  * Update rack RubyGem to version 2.2.12
  - Possible Log Injection in Rack::Sendfile (CVE-2025-27111)</changelog>
  <changelog author="enavarro@suse.com" date="1742299200">- Update to version 2.10.27
  Bugfixes
  ========
  Frontend:
  * Update rack RubyGem to version 2.2.13
  - Local file inclusion in Rack::Static (CVE-2025-27610)</changelog>
  <changelog author="enavarro@suse.com" date="1747396800">- Update to version 2.10.28
  Bugfixes
  ========
  Frontend:
  * Update rack RubyGem to version 2.2.14
  - Unbounded parameter parsing in Rack::QueryParser can lead to memory exhaustion (CVE-2025-46727)</changelog>
  <changelog author="enavarro@suse.com" date="1763640000">- Update to version 2.10.29
  Features
  ========
  Backend:
  * Support added for zstd compressed repomd meta data of download on demand repositories
  Bugfixes
  ========
  Frontend:
  * Update rack RubyGem to version 2.2.20
  - Unbounded parameter parsing in Rack::QueryParser can lead to memory exhaustion via semicolon-separated parameters (CVE-2025-59830)
  - Unbounded multipart preamble buffering enables DoS (memory exhaustion) (CVE-2025-61770)
  - Multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion) (CVE-2025-61771)
  - Multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion) (CVE-2025-61772)
  - Improper handling of headers in Rack::Sendfile may allow proxy bypass (CVE-2025-61780)
  - Unbounded read in Rack::Request form parsing can lead to memory exhaustion (CVE-2025-61919)</changelog>
  <changelog author="adrian@suse.de" date="1765972800">- Update to version 2.10.30
  Features
  ========
  Backend:
  * Switch to GPG version 4 signatures for debian repositories</changelog>
  <changelog author="enavarro@suse.com" date="1773144000">- Update to version 2.10.31
  Bugfixes
  ========
  Frontend:
  * Update rack RubyGem to version 2.2.22
  - XSS injection via malicious filename in Rack::Directory (CVE-2026-25500)
  - Directory traversal via root prefix bypass in Rack::Directory (CVE-2026-22860)</changelog>
  <changelog author="adrian@suse.de" date="1777377600">- Update to version 2.10.32
  * Support for Leap-16.0 and SLES-16.0 as server system added
  * Updated perl-BSSolv dependency library</changelog>
</package>
<package pkgid="d7c733bdc7223bf169dad6df99d0b17c2778912217a4712a509745efadc5ca61" name="system-user-obsrun" arch="noarch">
  <version epoch="0" ver="2.10.31" rel="150600.248.1"/>
  <changelog author="daniel.donisa@suse.com" date="1610452800">- Update to version 2.10.9
  Bugfixes
  ========
  * Frontend:
  - Update redcarpet gem to fix a security vulnerability.</changelog>
  <changelog author="hvogel@suse.com" date="1614254400">- Update to version 2.10.10
  Bugfixes
  ========
  * frontend:
  - CVE-2020-15169:      Potential XSS vulnerability in Action View
  - CVE-2020-8184:       Percent-encoded cookies can be used to overwrite existing
    prefixed cookie names
  - GHSA-g6wq-qcwm-j5g2: ReDoS vulnerability in Sec-WebSocket-Extensions parser
  - GHSA-vr8q-g5c7-m54m: Nokogiri::XML::Schema trusts input by default,
    exposing risk of an XXE vulnerability</changelog>
  <changelog author="hvogel@suse.com" date="1650369600">Update to version 2.10.13
  - Fix XML external entity (XXE) injection in xmlhash
    CVE-2022-21949
  - Update to Ruby 2.7
  - Fix heap memory corruption in yajl-ruby gem
    https://github.com/brianmario/yajl-ruby/security/advisories/GHSA-jj47-x69x-mxrm
  - Fix excessive backtracking in nokogiri gem
    https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-crjr-9rc5-ghw8
  - Fix priviledge escalation issue in ProjectDoProjectReleaseJob (#12407)</changelog>
  <changelog author="adrian@suse.de" date="1651060800">- Update to version 2.10.14
  - support zstd preinstallimages as produced by new build script</changelog>
  <changelog author="lukas.krause@suse.com" date="1651752000">- Update to version 2.10.15
  Bugfixes
  ========
  * Frontend:
  - Fix CVE-2022-22577: There is a possible XSS vulnerability in Rails / Action Pack. CSP headers
    were only sent along with responses that Rails considered as "HTML" responses. This left API
    requests without CSP headers, which could possibly expose users to XSS attacks.
  - Fix CVE-2022-27777: There is a possible XSS vulnerability in Action View tag helpers. Passing
    untrusted input as hash keys can lead to a possible XSS vulnerability</changelog>
  <changelog author="scabrerapadron@suse.de" date="1653566400">- Update to version 2.10.16
  Features
  ========
  Backend:
  * Support for qemu system emulated worker instances
  Bugfixes
  ========
  Frontend:
  * Update Nokogiri to version 1.13.6 to fix two security issues:
  - CVE-2022-29181 Improper Handling of Unexpected Data Type.
  * Update rack to 2.2.3.1
  - CVE-2022-30122 Denial of Service Vulnerability in Rack Multipart Parsing
  - CVE-2022-30123 Possible shell escape sequence injection</changelog>
  <changelog author="daniel.donisa@suse.com" date="1658145600">- Update to version 2.10.17
  Bugfixes
  ========
  Frontend:
  * Bug fix session leaking during BsRequest auto accept
  - See https://github.com/openSUSE/open-build-service/pull/12821
  * Update rails to 5.2.8.1
  - CVE-2022-32224 Possible RCE escalation bug with Serialized Columns in Active Record
  * Update tzinfo from 1.2.9 to 1.2.10
  - CVE-2022-31163 TZInfo relative path traversal vulnerability allows loading of arbitrary files</changelog>
  <changelog author="daniel.donisa@suse.com" date="1671105600">- Update to version 2.10.19
  Bugfixes
  ========
  Frontend:
  * Update rails-html-sanitizer to 1.4.4
  - CVE-2022-32209 Rails::Html::Sanitizer vulnerable to Cross-site Scripting
  * Fix support for qemu system emulated builds via bs_worker</changelog>
  <changelog author="lukas.krause@suse.com" date="1674820800">- Update to version 2.10.20
  Bugfixes
  ========
  Frontend:
  * Update globalid gem from 1.0.0 to 1.0.1
  - Fixes CVE-2023-22799 ReDoS based DoS vulnerability in the GlobalID gem
  * Update rack gem from 2.2.4 to 2.2.6.2
  - Fixes CVE-2022-44571 Denial of service vulnerability in the Content-Disposition parsing
    component of Rack.
  - Fixes CVE-2022-44572 Denial of service vulnerability in the multipart parsing component
    of Rack.
  - Fixes CVE-2022-44570 Possible denial of service vulnerability in the Range header
    parsing component of Rack.</changelog>
  <changelog author="daniel.donisa@suse.com" date="1678968000">- Update to version 2.10.21
  Bugfixes
  ========
  Frontend:
  * Update rack to version 2.2.6.4
  - Fixes CVE-2023-27539 Avoid ReDoS (https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS) in header parsing.
  - Fixes CVE-2023-27530 Possible DoS Vulnerability in Multipart MIME parsing.+</changelog>
  <changelog author="daniel.donisa@suse.com" date="1709294400">- Update to version 2.10.22
  Bugfixes
  ========
  Frontend:
  * Update rack to version 2.2.8.1
  - Fixed ReDoS in Accept header parsing [CVE-2024-26146]
  - Fixed ReDoS in Content Type header parsing [CVE-2024-25126]
  - Reject Range headers which are too large [CVE-2024-26141] DoS Vulnerability in Multipart MIME parsing.</changelog>
  <changelog author="adrian@suse.de" date="1739534400">- Update to version 2.10.24
  * Support usage of scmsync source from remote OBS instances
  * Fix linking of remote backend only packages
  * Handle "manual" source service modes
  * bs_worker: export cpu features as flags (for s390)
  * Update kiwi schema to current state
  * Using 15.6 as default OBS server host OS</changelog>
  <changelog author="dleidi@suse.com" date="1740484800">- Update to version 2.10.25
  Bugfixes
  ========
  Frontend:
  * Update rack to version 2.2.11
  - [CVE-2025-25184] Fix possible log Injection in `Rack::CommonLogger`</changelog>
  <changelog author="enavarro@suse.com" date="1741262400">- Update to version 2.10.26
  Bugfixes
  ========
  Frontend:
  * Update rack RubyGem to version 2.2.12
  - Possible Log Injection in Rack::Sendfile (CVE-2025-27111)</changelog>
  <changelog author="enavarro@suse.com" date="1742299200">- Update to version 2.10.27
  Bugfixes
  ========
  Frontend:
  * Update rack RubyGem to version 2.2.13
  - Local file inclusion in Rack::Static (CVE-2025-27610)</changelog>
  <changelog author="enavarro@suse.com" date="1747396800">- Update to version 2.10.28
  Bugfixes
  ========
  Frontend:
  * Update rack RubyGem to version 2.2.14
  - Unbounded parameter parsing in Rack::QueryParser can lead to memory exhaustion (CVE-2025-46727)</changelog>
  <changelog author="enavarro@suse.com" date="1763640000">- Update to version 2.10.29
  Features
  ========
  Backend:
  * Support added for zstd compressed repomd meta data of download on demand repositories
  Bugfixes
  ========
  Frontend:
  * Update rack RubyGem to version 2.2.20
  - Unbounded parameter parsing in Rack::QueryParser can lead to memory exhaustion via semicolon-separated parameters (CVE-2025-59830)
  - Unbounded multipart preamble buffering enables DoS (memory exhaustion) (CVE-2025-61770)
  - Multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion) (CVE-2025-61771)
  - Multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion) (CVE-2025-61772)
  - Improper handling of headers in Rack::Sendfile may allow proxy bypass (CVE-2025-61780)
  - Unbounded read in Rack::Request form parsing can lead to memory exhaustion (CVE-2025-61919)</changelog>
  <changelog author="adrian@suse.de" date="1765972800">- Update to version 2.10.30
  Features
  ========
  Backend:
  * Switch to GPG version 4 signatures for debian repositories</changelog>
  <changelog author="enavarro@suse.com" date="1773144000">- Update to version 2.10.31
  Bugfixes
  ========
  Frontend:
  * Update rack RubyGem to version 2.2.22
  - XSS injection via malicious filename in Rack::Directory (CVE-2026-25500)
  - Directory traversal via root prefix bypass in Rack::Directory (CVE-2026-22860)</changelog>
  <changelog author="adrian@suse.de" date="1777377600">- Update to version 2.10.32
  * Support for Leap-16.0 and SLES-16.0 as server system added
  * Updated perl-BSSolv dependency library</changelog>
</package>
<package pkgid="65bc5a6e9b4b0cde07060629cc14a7d4252552fed3a69123e2cabb611a5a3c31" name="system-user-obsservicerun" arch="noarch">
  <version epoch="0" ver="2.10.31" rel="150600.248.1"/>
  <changelog author="daniel.donisa@suse.com" date="1610452800">- Update to version 2.10.9
  Bugfixes
  ========
  * Frontend:
  - Update redcarpet gem to fix a security vulnerability.</changelog>
  <changelog author="hvogel@suse.com" date="1614254400">- Update to version 2.10.10
  Bugfixes
  ========
  * frontend:
  - CVE-2020-15169:      Potential XSS vulnerability in Action View
  - CVE-2020-8184:       Percent-encoded cookies can be used to overwrite existing
    prefixed cookie names
  - GHSA-g6wq-qcwm-j5g2: ReDoS vulnerability in Sec-WebSocket-Extensions parser
  - GHSA-vr8q-g5c7-m54m: Nokogiri::XML::Schema trusts input by default,
    exposing risk of an XXE vulnerability</changelog>
  <changelog author="hvogel@suse.com" date="1650369600">Update to version 2.10.13
  - Fix XML external entity (XXE) injection in xmlhash
    CVE-2022-21949
  - Update to Ruby 2.7
  - Fix heap memory corruption in yajl-ruby gem
    https://github.com/brianmario/yajl-ruby/security/advisories/GHSA-jj47-x69x-mxrm
  - Fix excessive backtracking in nokogiri gem
    https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-crjr-9rc5-ghw8
  - Fix priviledge escalation issue in ProjectDoProjectReleaseJob (#12407)</changelog>
  <changelog author="adrian@suse.de" date="1651060800">- Update to version 2.10.14
  - support zstd preinstallimages as produced by new build script</changelog>
  <changelog author="lukas.krause@suse.com" date="1651752000">- Update to version 2.10.15
  Bugfixes
  ========
  * Frontend:
  - Fix CVE-2022-22577: There is a possible XSS vulnerability in Rails / Action Pack. CSP headers
    were only sent along with responses that Rails considered as "HTML" responses. This left API
    requests without CSP headers, which could possibly expose users to XSS attacks.
  - Fix CVE-2022-27777: There is a possible XSS vulnerability in Action View tag helpers. Passing
    untrusted input as hash keys can lead to a possible XSS vulnerability</changelog>
  <changelog author="scabrerapadron@suse.de" date="1653566400">- Update to version 2.10.16
  Features
  ========
  Backend:
  * Support for qemu system emulated worker instances
  Bugfixes
  ========
  Frontend:
  * Update Nokogiri to version 1.13.6 to fix two security issues:
  - CVE-2022-29181 Improper Handling of Unexpected Data Type.
  * Update rack to 2.2.3.1
  - CVE-2022-30122 Denial of Service Vulnerability in Rack Multipart Parsing
  - CVE-2022-30123 Possible shell escape sequence injection</changelog>
  <changelog author="daniel.donisa@suse.com" date="1658145600">- Update to version 2.10.17
  Bugfixes
  ========
  Frontend:
  * Bug fix session leaking during BsRequest auto accept
  - See https://github.com/openSUSE/open-build-service/pull/12821
  * Update rails to 5.2.8.1
  - CVE-2022-32224 Possible RCE escalation bug with Serialized Columns in Active Record
  * Update tzinfo from 1.2.9 to 1.2.10
  - CVE-2022-31163 TZInfo relative path traversal vulnerability allows loading of arbitrary files</changelog>
  <changelog author="daniel.donisa@suse.com" date="1671105600">- Update to version 2.10.19
  Bugfixes
  ========
  Frontend:
  * Update rails-html-sanitizer to 1.4.4
  - CVE-2022-32209 Rails::Html::Sanitizer vulnerable to Cross-site Scripting
  * Fix support for qemu system emulated builds via bs_worker</changelog>
  <changelog author="lukas.krause@suse.com" date="1674820800">- Update to version 2.10.20
  Bugfixes
  ========
  Frontend:
  * Update globalid gem from 1.0.0 to 1.0.1
  - Fixes CVE-2023-22799 ReDoS based DoS vulnerability in the GlobalID gem
  * Update rack gem from 2.2.4 to 2.2.6.2
  - Fixes CVE-2022-44571 Denial of service vulnerability in the Content-Disposition parsing
    component of Rack.
  - Fixes CVE-2022-44572 Denial of service vulnerability in the multipart parsing component
    of Rack.
  - Fixes CVE-2022-44570 Possible denial of service vulnerability in the Range header
    parsing component of Rack.</changelog>
  <changelog author="daniel.donisa@suse.com" date="1678968000">- Update to version 2.10.21
  Bugfixes
  ========
  Frontend:
  * Update rack to version 2.2.6.4
  - Fixes CVE-2023-27539 Avoid ReDoS (https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS) in header parsing.
  - Fixes CVE-2023-27530 Possible DoS Vulnerability in Multipart MIME parsing.+</changelog>
  <changelog author="daniel.donisa@suse.com" date="1709294400">- Update to version 2.10.22
  Bugfixes
  ========
  Frontend:
  * Update rack to version 2.2.8.1
  - Fixed ReDoS in Accept header parsing [CVE-2024-26146]
  - Fixed ReDoS in Content Type header parsing [CVE-2024-25126]
  - Reject Range headers which are too large [CVE-2024-26141] DoS Vulnerability in Multipart MIME parsing.</changelog>
  <changelog author="adrian@suse.de" date="1739534400">- Update to version 2.10.24
  * Support usage of scmsync source from remote OBS instances
  * Fix linking of remote backend only packages
  * Handle "manual" source service modes
  * bs_worker: export cpu features as flags (for s390)
  * Update kiwi schema to current state
  * Using 15.6 as default OBS server host OS</changelog>
  <changelog author="dleidi@suse.com" date="1740484800">- Update to version 2.10.25
  Bugfixes
  ========
  Frontend:
  * Update rack to version 2.2.11
  - [CVE-2025-25184] Fix possible log Injection in `Rack::CommonLogger`</changelog>
  <changelog author="enavarro@suse.com" date="1741262400">- Update to version 2.10.26
  Bugfixes
  ========
  Frontend:
  * Update rack RubyGem to version 2.2.12
  - Possible Log Injection in Rack::Sendfile (CVE-2025-27111)</changelog>
  <changelog author="enavarro@suse.com" date="1742299200">- Update to version 2.10.27
  Bugfixes
  ========
  Frontend:
  * Update rack RubyGem to version 2.2.13
  - Local file inclusion in Rack::Static (CVE-2025-27610)</changelog>
  <changelog author="enavarro@suse.com" date="1747396800">- Update to version 2.10.28
  Bugfixes
  ========
  Frontend:
  * Update rack RubyGem to version 2.2.14
  - Unbounded parameter parsing in Rack::QueryParser can lead to memory exhaustion (CVE-2025-46727)</changelog>
  <changelog author="enavarro@suse.com" date="1763640000">- Update to version 2.10.29
  Features
  ========
  Backend:
  * Support added for zstd compressed repomd meta data of download on demand repositories
  Bugfixes
  ========
  Frontend:
  * Update rack RubyGem to version 2.2.20
  - Unbounded parameter parsing in Rack::QueryParser can lead to memory exhaustion via semicolon-separated parameters (CVE-2025-59830)
  - Unbounded multipart preamble buffering enables DoS (memory exhaustion) (CVE-2025-61770)
  - Multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion) (CVE-2025-61771)
  - Multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion) (CVE-2025-61772)
  - Improper handling of headers in Rack::Sendfile may allow proxy bypass (CVE-2025-61780)
  - Unbounded read in Rack::Request form parsing can lead to memory exhaustion (CVE-2025-61919)</changelog>
  <changelog author="adrian@suse.de" date="1765972800">- Update to version 2.10.30
  Features
  ========
  Backend:
  * Switch to GPG version 4 signatures for debian repositories</changelog>
  <changelog author="enavarro@suse.com" date="1773144000">- Update to version 2.10.31
  Bugfixes
  ========
  Frontend:
  * Update rack RubyGem to version 2.2.22
  - XSS injection via malicious filename in Rack::Directory (CVE-2026-25500)
  - Directory traversal via root prefix bypass in Rack::Directory (CVE-2026-22860)</changelog>
  <changelog author="adrian@suse.de" date="1777377600">- Update to version 2.10.32
  * Support for Leap-16.0 and SLES-16.0 as server system added
  * Updated perl-BSSolv dependency library</changelog>
</package>
</otherdata>