File _patchinfo of Package patchinfo.19103
<patchinfo incident="19103">
<issue tracker="cve" id="2025-40914"/>
<packager>okurz</packager>
<rating>moderate</rating>
<category>recommended</category>
<summary>Recommended update for openQA, openQA-devel-container, os-autoinst, perl-CryptX, perl-IPC-Run, perl-JSON-Validator, perl-MCP, perl-Mojolicious</summary>
<description>This update for openQA, openQA-devel-container, os-autoinst, perl-CryptX, perl-IPC-Run, perl-JSON-Validator, perl-MCP, perl-Mojolicious fixes the following issues:
Changes in openQA:
- Update to version 5.1757005118.aac56dbc:
* CI: Fix SLE_15_SP6_Backports repo lookup order
* Add perl(MCP) dependency in preparation for AI support
* build(deps-dev): bump @humanfs/node from 0.16.6 to 0.16.7
* Revert "MCP: Add MCP support as an optional feature"
* Fix typo on Contributing documentation
* Add MCP support as an optional feature
* Reword `can't write` to `Cannot write` as suggested by review comment
* Ensure destination dir for asset downloads exists when cloning jobs
* build(deps): bump ace-builds from 1.43.2 to 1.43.3
- Update to version 5.1756962167.74f0204f:
* Dependency cron 2025-09-04
- Update to version 5.1756905114.bb4fa746:
* Fix syntax error in nginx config
* Mark unconfigured api route log as uncoverable statement
* Increase test coverage for lib/OpenQA/WebAPI/Description.pm
* parser: ktap: Don't write diagnostic data into $subtest_name
* Extend tests for configuring subdomain to serve files
* Avoid job terminated unexpectedly with signal handler in delete needles
* Allow configuring subdomain for serving logs/assets more securely
* Do not invoke Mojo::IOLoop->remove twice
* Add support for Bearer token authentication
* Worker::Engines::isotovideo: Simplify using more Mojo::File
* Worker::Engines::isotovideo: Remove obsolete comment
Changes in openQA-devel-container:
- Update to version 5.1757005118.aac56dbcc:
* Update to latest openQA version
Changes in os-autoinst:
- Update to version 5.1756894972.736fbfd:
* baseclass: Fix missing error details on failed SSH connection attempts
* baseclass: Extend error details on failed ssh attempts
* consoles: Improve error reporting on unavailable VNC
* backend::svirt: Extract methods for serial_console command
* backend::svirt: Extract method for serial_grab command
* backend::svirt: Combine and simplify save_snapshot commands
* backend::svirt: Extract method 'vmname'
* backend::svirt: Extract methods for is_shutdown cmd
Changes in perl-JSON-Validator:
- updated to 5.150.0 (5.15)
see /usr/share/doc/packages/perl-JSON-Validator/Changes
5.15 2025-03-16T18:47:47
- Make JSON::Validator::Util::is_bool return true when passed perl v5.36+ builtin booleans #275
- Fix wrong resolving of responses component using $ref #277
- Fix array coercion for array parameters with a $ref schema #274
Changes in perl-IPC-Run:
- updated to 20231003.0
see /usr/share/doc/packages/perl-IPC-Run/Changelog
20231003.0 Mon Oct 2 2023
Windows now matches other platforms in that a child calling exit(N) causes
result() to return N and full_result() to return N << 8. On Windows, before
this change, result() was returning N >> 8, and full_result() was returning N.
Programs having workarounds for this may need to condition those workarounds on
$IPC::Run::VERSION.
- #157 - On Windows, avoid hang under IPCRUNDEBUG.
- Refresh "cpanfile" from Makefile.PL, to allow use on Windows.
- #163 - Normalize shebangs to /usr/bin/perl
- Fix or skip all tests recently seen to fail on Windows.
- Include t/result.t in releases.
- #168 - Make full_result() and result() Windows behavior match non-Windows.
Changes in perl-CryptX:
- updated to 0.87.0 (0.087)
see /usr/share/doc/packages/perl-CryptX/Changes
0.087 2025-06-11
- bundled libtomcrypt update branch:develop (commit: d448df1 2025-05-06)
- bundled libtommath update branch:develop (commit: 839ae9e 2025-06-11)
- fix #120 Create SECURITY.md
- fix #121 Failures on ARM after upgrading libtommath
- security fix CVE-2025-40914 https://github.com/DCIT/perl-CryptX/security/advisories/GHSA-6fh3-7qjq-8v22
- updated to 0.86.0 (0.086)
see /usr/share/doc/packages/perl-CryptX/Changes
0.086 2025-05-02
- fixe #118 Syncing with recent Math-BigInt
- bundled libtomcrypt update branch:develop (commit:3905c289 2025-04-23)
- updated to 0.85.0 (0.085)
see /usr/share/doc/packages/perl-CryptX/Changes
0.085 2025-02-08
- fix #114 #113 #112 (improved detection of Apple+x86_64 / AESNI)
- fix #115 Crypt::PRNG - fix typo and specify ChaCha20 is the default
- updated to 0.84.0 (0.084)
see /usr/share/doc/packages/perl-CryptX/Changes
0.084 2024-10-16
- libtommath: fix cpantesters crash on freebsd/i386
- updated ppport.h
0.083 2024-10-15
- fix #110 regression: 0.081 fails to parse PEMs that 0.080 parsed fine
- bundled libtomcrypt update branch:develop (commit:cbb01b37 2024-10-14)
0.082 2024-10-07
- fix #111 libcryptx-perl: t/sshkey.t fails on some architectures
- CHANGE: Crypt::Cipher::Blowfish max key size increased to 72 bytes
- bundled libtomcrypt update branch:develop (commit:29af8922 2024-10-07)
0.081 2024-09-08
- fix #107 Drop -msse4.1 -maes for libtomcrypt
- fix #105 Several functions in CryptX::AuthEnc deal weirdly with non-simple-string plaintext
- fix #104 Add ethereum format signature
- fix #103 Use standard __asm__ blocks instead of asm
- fix #99 ltc: fix aesni flag handling
- fix #87 Add possibility to use different hash algorithms in RSAES-OAEP
- BIG CHANGE switch to PEM/SSH key loading via libtomcrypt
- bundled libtomcrypt update branch:develop (commit:ce904c86 2024-09-02)
Changes in perl-MCP:
- initial package 0.40.0 (0.04)
* created by cpanspec 1.84.01
Changes in perl-Mojolicious:
- updated to 9.410.0 (9.41)
see /usr/share/doc/packages/perl-Mojolicious/Changes
9.41 2025-07-03
- Added EXPERIMENTAL support for Server-Sent Events.
- Added EXPERIMENTAL module Mojo::SSE.
- Added EXPERIMENTAL sse attribute to Test::Mojo.
- Added EXPERIMENTAL get_sse_ok, post_sse_ok, sse_finish_ok, sse_finished_ok, sse_ok, sse_id_is, sse_id_isnt,
sse_text_is, sse_text_isnt, sse_text_like, sse_text_unlike, sse_type_is and sse_type_isnt methods to Test::Mojo.
- Added EXPERIMENTAL is_sse and write_sse methods to Mojo::Content.
- Added EXPERIMENTAL write_sse method to Mojolicious::Controller.
- Added EXPERIMENTAL sse event to Mojo::Content.
- Fixed a bug where query parameters could not be set to undef. (ether)
- Fixed a bug where Host headers were not initialized correctly. (ether)
- updated to 9.400.0 (9.40)
see /usr/share/doc/packages/perl-Mojolicious/Changes
9.40 2025-05-12
- Added EXPERIMENTAL support for resumable file downloads.
- Added EXPERIMENTAL download methods to Mojo::File and Mojo::UserAgent::Transactor.
- updated to 9.390.0 (9.39)
see /usr/share/doc/packages/perl-Mojolicious/Changes
9.39 2024-11-23
- Added EXPERIMENTAL support for encrypted session cookies.
This feature is much more secure than signed cookies and can be enabled by installing CryptX and setting the
encrypted attribute.
$app->sessions->encrypted(1);
- Added EXPERIMENTAL encrypted attribute to Mojolicious::Sessions.
- Added EXPERIMENTAL encrypted_cookie and every_encrypted_cookie methods to Mojolicious::Controller.
- Added EXPERIMENTAL decrypt_cookie, encrypt_cookie and generate_secret functions to Mojo::Util.
- Fixed a bug in Mojo::Message::Request where message size limits were not always correctly applied.
(Alexander Kuehne)
- updated to 9.380.0 (9.38)
see /usr/share/doc/packages/perl-Mojolicious/Changes
9.38 2024-08-17
- Added support for new core booleans in Perl 5.36+ to Mojo::JSON. (haarg)
- Deprecated support for "'" package separators that have been deprecated in Perl. (Grinnz)
- updated to 9.37
see /usr/share/doc/packages/perl-Mojolicious/Changes
9.37 2024-05-13
- Improved Mojo::Base include time with a new Mojo::BaseUtils module. (okurz)
- updated to 9.36
see /usr/share/doc/packages/perl-Mojolicious/Changes
9.36 2024-03-06
- Updated Bootstrap from version 4 to 5. (sergiotarxz)
- Improved Morbo to restart on deleted files. (hernan604)
</description>
</patchinfo>
