Overview

File fix-CVE-2025-3445.patch of Package failed_forgejo-longterm

diff -rub forgejo-src-10.0.3/go.sum forgejo-src-10.0.3-patched/go.sum
--- forgejo-src-10.0.3/go.sum	2025-04-16 09:14:02.946216659 +0200
+++ forgejo-src-10.0.3-patched/go.sum	2025-04-16 09:24:43.768515485 +0200
@@ -1505,8 +1505,6 @@
 golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
 golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliYc=
 golang.org/x/crypto v0.17.0/go.mod h1:gCAAfMLgwOJRpTjQ2zCCt2OcSfYMTeZVSRtQlPC7Nq4=
-golang.org/x/crypto v0.35.0 h1:b15kiHdrGCHrP6LvwaQ3c03kgNhhiMgvlhxHQhmg2Xs=
-golang.org/x/crypto v0.35.0/go.mod h1:dy7dXNW32cAb/6/PRuTNsix8T+vJAqvuIy5Bli/x0YQ=
 golang.org/x/crypto v0.36.0 h1:AnAEvhDddvBdpY+uR+MyHmuZzzNqXSe/GvuDeob5L34=
 golang.org/x/crypto v0.36.0/go.mod h1:Y4J0ReaxCR1IMaabaSMugxJES1EpwhBHhv2bDHklZvc=
 golang.org/x/exp v0.0.0-20180321215751-8460e604b9de/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
@@ -1682,8 +1680,6 @@
 golang.org/x/sync v0.0.0-20220819030929-7fc1605a5dde/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220929204114-8fcdb60fdcc0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.11.0 h1:GGz8+XQP4FvTTrjZPzNKTMFtSXH80RAzG+5ghFPgK9w=
-golang.org/x/sync v0.11.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sync v0.12.0 h1:MHc5BpPuC30uJk597Ri8TV3CNZcTLu6B6z4lJy+g6Jw=
 golang.org/x/sync v0.12.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -1775,8 +1771,6 @@
 golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.15.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.30.0 h1:QjkSwP/36a20jFYWkSue1YwXzLmsV5Gfq7Eiy72C1uc=
-golang.org/x/sys v0.30.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.31.0 h1:ioabZlmFYtWhL+TRYpcnNlLwhyxaM9kWTDEmfnprqik=
 golang.org/x/sys v0.31.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
@@ -1790,8 +1784,8 @@
 golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
 golang.org/x/term v0.12.0/go.mod h1:owVbMEjm3cBLCHdkQu9b1opXd4ETQWc3BhuQGKgXgvU=
 golang.org/x/term v0.15.0/go.mod h1:BDl952bC7+uMoWR75FIrCDx79TPU9oHkTZ9yRbYOrX0=
-golang.org/x/term v0.29.0 h1:L6pJp37ocefwRRtYPKSWOWzOtWSxVajvz2ldH/xi3iU=
-golang.org/x/term v0.29.0/go.mod h1:6bl4lRlvVuDgSf3179VpIxBF0o10JUpXWOnI7nErv7s=
+golang.org/x/term v0.30.0 h1:PQ39fJZ+mfadBm0y5WlL4vlM7Sx1Hgf13sMIY2+QS9Y=
+golang.org/x/term v0.30.0/go.mod h1:NYYFdzHoI5wRh/h5tDMdMqCqPJZEuNqVR5xJLd/n67g=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -1810,8 +1804,6 @@
 golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
 golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
-golang.org/x/text v0.22.0 h1:bofq7m3/HAFvbF51jz3Q9wLg3jkvSPuiZu/pD1XwgtM=
-golang.org/x/text v0.22.0/go.mod h1:YRoo4H8PVmsu+E3Ou7cqLVH8oXWIHVoX0jqUWALQhfY=
 golang.org/x/text v0.23.0 h1:D71I7dUrlY+VX0gQShAThNGHFxZ13dGLBHQLVl1mJlY=
 golang.org/x/text v0.23.0/go.mod h1:/BLNzu4aZCJ1+kcD0DNRotWKage4q2rGVAg4o22unh4=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
diff -rub forgejo-src-10.0.3/vendor/golang.org/x/crypto/ssh/messages.go forgejo-src-10.0.3-patched/vendor/golang.org/x/crypto/ssh/messages.go
--- forgejo-src-10.0.3/vendor/golang.org/x/crypto/ssh/messages.go	2025-03-23 08:02:52.000000000 +0100
+++ forgejo-src-10.0.3-patched/vendor/golang.org/x/crypto/ssh/messages.go	2025-04-16 09:15:52.582420672 +0200
@@ -818,6 +818,8 @@
 		return new(userAuthSuccessMsg), nil
 	case msgUserAuthFailure:
 		msg = new(userAuthFailureMsg)
+	case msgUserAuthBanner:
+		msg = new(userAuthBannerMsg)
 	case msgUserAuthPubKeyOk:
 		msg = new(userAuthPubKeyOkMsg)
 	case msgGlobalRequest:
diff -rub forgejo-src-10.0.3/vendor/golang.org/x/crypto/ssh/tcpip.go forgejo-src-10.0.3-patched/vendor/golang.org/x/crypto/ssh/tcpip.go
--- forgejo-src-10.0.3/vendor/golang.org/x/crypto/ssh/tcpip.go	2025-03-23 08:02:52.000000000 +0100
+++ forgejo-src-10.0.3-patched/vendor/golang.org/x/crypto/ssh/tcpip.go	2025-04-16 09:15:52.583420673 +0200
@@ -459,7 +459,7 @@
 		return nil, err
 	}
 	go DiscardRequests(in)
-	return ch, err
+	return ch, nil
 }
 
 type tcpChan struct {
diff -rub forgejo-src-10.0.3/vendor/golang.org/x/sync/errgroup/errgroup.go forgejo-src-10.0.3-patched/vendor/golang.org/x/sync/errgroup/errgroup.go
--- forgejo-src-10.0.3/vendor/golang.org/x/sync/errgroup/errgroup.go	2025-03-23 08:02:52.000000000 +0100
+++ forgejo-src-10.0.3-patched/vendor/golang.org/x/sync/errgroup/errgroup.go	2025-04-16 09:15:52.723612285 +0200
@@ -46,7 +46,7 @@
 // returns a non-nil error or the first time Wait returns, whichever occurs
 // first.
 func WithContext(ctx context.Context) (*Group, context.Context) {
-	ctx, cancel := withCancelCause(ctx)
+	ctx, cancel := context.WithCancelCause(ctx)
 	return &Group{cancel: cancel}, ctx
 }
 
Only in forgejo-src-10.0.3/vendor/golang.org/x/sync/errgroup: go120.go
Only in forgejo-src-10.0.3/vendor/golang.org/x/sync/errgroup: pre_go120.go
diff -rub forgejo-src-10.0.3/vendor/golang.org/x/text/internal/number/format.go forgejo-src-10.0.3-patched/vendor/golang.org/x/text/internal/number/format.go
--- forgejo-src-10.0.3/vendor/golang.org/x/text/internal/number/format.go	2025-03-23 08:02:52.000000000 +0100
+++ forgejo-src-10.0.3-patched/vendor/golang.org/x/text/internal/number/format.go	2025-04-16 09:15:52.860421189 +0200
@@ -394,9 +394,7 @@
 	exp := n.Exp - int32(n.Comma)
 	exponential := f.Symbol(SymExponential)
 	if exponential == "E" {
-		dst = append(dst, "\u202f"...) // NARROW NO-BREAK SPACE
 		dst = append(dst, f.Symbol(SymSuperscriptingExponent)...)
-		dst = append(dst, "\u202f"...) // NARROW NO-BREAK SPACE
 		dst = f.AppendDigit(dst, 1)
 		dst = f.AppendDigit(dst, 0)
 		switch {
diff -rub forgejo-src-10.0.3/vendor/golang.org/x/text/language/parse.go forgejo-src-10.0.3-patched/vendor/golang.org/x/text/language/parse.go
--- forgejo-src-10.0.3/vendor/golang.org/x/text/language/parse.go	2025-03-23 08:02:52.000000000 +0100
+++ forgejo-src-10.0.3-patched/vendor/golang.org/x/text/language/parse.go	2025-04-16 09:15:52.865421198 +0200
@@ -59,7 +59,7 @@
 	if changed {
 		tt.RemakeString()
 	}
-	return makeTag(tt), err
+	return makeTag(tt), nil
 }
 
 // Compose creates a Tag from individual parts, which may be of type Tag, Base,
diff -rub forgejo-src-10.0.3/vendor/modules.txt forgejo-src-10.0.3-patched/vendor/modules.txt
--- forgejo-src-10.0.3/vendor/modules.txt	2025-03-23 08:02:52.000000000 +0100
+++ forgejo-src-10.0.3-patched/vendor/modules.txt	2025-04-16 09:15:53.330422062 +0200
@@ -195,6 +195,8 @@
 github.com/RoaringBitmap/roaring
 github.com/RoaringBitmap/roaring/internal
 github.com/RoaringBitmap/roaring/roaring64
+# github.com/STARRY-S/zip v0.2.1
+## explicit; go 1.22.2
 # github.com/SaveTheRbtz/zstd-seekable-format-go/pkg v0.7.2
 ## explicit; go 1.22
 github.com/SaveTheRbtz/zstd-seekable-format-go/pkg
@@ -328,6 +330,12 @@
 # github.com/blevesearch/zapx/v16 v16.1.9-0.20241217210638-a0519e7caf3b
 ## explicit; go 1.21
 github.com/blevesearch/zapx/v16
+# github.com/bodgit/plumbing v1.3.0
+## explicit; go 1.13
+# github.com/bodgit/sevenzip v1.6.0
+## explicit; go 1.19
+# github.com/bodgit/windows v1.0.1
+## explicit; go 1.13
 # github.com/boombuler/barcode v1.0.1
 ## explicit
 github.com/boombuler/barcode
@@ -777,9 +785,13 @@
 # github.com/gorilla/sessions v1.4.0
 ## explicit; go 1.23
 github.com/gorilla/sessions
+# github.com/hashicorp/errwrap v1.1.0
+## explicit
 # github.com/hashicorp/go-cleanhttp v0.5.2
 ## explicit; go 1.13
 github.com/hashicorp/go-cleanhttp
+# github.com/hashicorp/go-multierror v1.1.1
+## explicit; go 1.13
 # github.com/hashicorp/go-retryablehttp v0.7.7
 ## explicit; go 1.19
 github.com/hashicorp/go-retryablehttp
@@ -904,6 +916,8 @@
 # github.com/mholt/archiver/v3 v3.5.1 => code.forgejo.org/forgejo/archiver/v3 v3.5.1
 ## explicit; go 1.13
 github.com/mholt/archiver/v3
+# github.com/mholt/archiver/v4 v4.0.0-alpha.9.0.20241119165213-3ce15a5ce077
+## explicit; go 1.22.2
 # github.com/microcosm-cc/bluemonday v1.0.27
 ## explicit; go 1.19
 github.com/microcosm-cc/bluemonday
@@ -963,6 +977,8 @@
 # github.com/nwaples/rardecode v1.1.3
 ## explicit
 github.com/nwaples/rardecode
+# github.com/nwaples/rardecode/v2 v2.0.0-beta.4.0.20241112120701-034e449c6e78
+## explicit; go 1.16
 # github.com/olekukonko/tablewriter v0.0.5
 ## explicit; go 1.12
 github.com/olekukonko/tablewriter
@@ -1081,6 +1097,8 @@
 # github.com/skeema/knownhosts v1.3.0
 ## explicit; go 1.17
 github.com/skeema/knownhosts
+# github.com/sorairolake/lzip-go v0.3.5
+## explicit; go 1.22
 # github.com/ssor/bom v0.0.0-20170718123548-6386211fdfcf
 ## explicit
 github.com/ssor/bom
@@ -1104,6 +1122,8 @@
 github.com/syndtr/goleveldb/leveldb/storage
 github.com/syndtr/goleveldb/leveldb/table
 github.com/syndtr/goleveldb/leveldb/util
+# github.com/therootcompany/xz v1.0.1
+## explicit; go 1.15
 # github.com/ulikunitz/xz v0.5.12
 ## explicit; go 1.12
 github.com/ulikunitz/xz
@@ -1257,7 +1277,9 @@
 go.uber.org/zap/internal/pool
 go.uber.org/zap/internal/stacktrace
 go.uber.org/zap/zapcore
-# golang.org/x/crypto v0.35.0
+# go4.org v0.0.0-20230225012048-214862532bf5
+## explicit; go 1.13
+# golang.org/x/crypto v0.36.0
 ## explicit; go 1.23.0
 golang.org/x/crypto/argon2
 golang.org/x/crypto/bcrypt
@@ -1332,19 +1354,19 @@
 golang.org/x/oauth2/internal
 golang.org/x/oauth2/jws
 golang.org/x/oauth2/jwt
-# golang.org/x/sync v0.11.0
-## explicit; go 1.18
+# golang.org/x/sync v0.12.0
+## explicit; go 1.23.0
 golang.org/x/sync/errgroup
 golang.org/x/sync/semaphore
-# golang.org/x/sys v0.30.0
-## explicit; go 1.18
+# golang.org/x/sys v0.31.0
+## explicit; go 1.23.0
 golang.org/x/sys/cpu
 golang.org/x/sys/execabs
 golang.org/x/sys/unix
 golang.org/x/sys/windows
 golang.org/x/sys/windows/registry
-# golang.org/x/text v0.22.0
-## explicit; go 1.18
+# golang.org/x/text v0.23.0
+## explicit; go 1.23.0
 golang.org/x/text/cases
 golang.org/x/text/collate
 golang.org/x/text/encoding
openSUSE Build Service is sponsored by
Places