Описание
Security update for openQA, os-autoinst, openQA-devel-container
This update for openQA, os-autoinst, openQA-devel-container fixes the following issues:
Changes in openQA:
-
Update to version 5.1771422749.560a3b26:
- fix(mcp): set navbar check expression to read-only
- feat: support inverted result filters in /tests/overview
- fix(test): Enable helm install-chart test again
- git subrepo pull (merge) --force external/os-autoinst-common
- feat: Make allowed hosts for SCENARIO_DEFINITIONS_YAML_FILE configurable
- test: Consider everything under
lib/OpenQA/Shared/covered - fix: Provide specific error message if job was removed
enqueue_…_track - refactor: Remove useless error message in
enqueue_and_keep_track - test: Cover case of successful executing in
enqueue_and_keep_track - refactor: Simplify error handling of
enqueue_and_keep_track - test: Cover error handling of
enqueue_and_keep_track - test: Consider shared session controller fully covered
- refactor: Avoid duplications in sessions controller
- refactor: Use signatures in session controller code
- test: Cover error handling in case of a bad CRSF token
- test: Cover test route for session
- fix(worker): reject jobs explicitly when worker is stopping
- feat: Remove workaround for codecov and gpg
- feat: Switch to Leap 16 in Helm charts
- feat: Switch to Leap 16.0 in openqa_data container
- feat: Replace all Leap 15.6 with 16.0 in docs and scripts
- test: Cover showing special image when backend has terminated
- fix: Use new apachectl command
- Update openQA containers to Leap 16.0
- test: Extend tests for controller handling live view
- refactor: Move throttling into its own function
- feat(throttling): throttle jobs resources based on parameters size
- refactor: Avoid repeated use of
$t->app->minionin gru tasks tests - feat: Allow archiving jobs with infinite important storage durations
- feat: Flag jobs without results as archived for consistency
- feat: Remove one corner case preventing jobs from being archived
-
Update to version 5.1770718745.ce2072d3:
- feat(ui): use clickable test overview summary counts for quick filtering
- build(Makefile): fix uninterruptable tests
- docs: Mention caveats of
…_cleanup_max_free_percentagesetting - test(25-cache-service): fix race conditions
- test(ui/21-admin-needles): properly wait for modal dialog and deletion
- test(ui/13-admin): properly wait for API key deletion
- test(40-openqa-clone-job): properly isolate from system config
- test(15-asset): bump timeout to current runtime
- chore: fix CVE-2026-25547 (boo#1257852) by overriding minimatch
- build(deps-dev): bump @eslint from 9.36.0 to 9.38.0
- fix(eslint): correct style to be eslint-9.38 compliant
- build(deps-dev): bump @eslint-community/regexpp from 4.12.1 to 4.12.2
- build(deps-dev): bump @eslint/config-array from 0.21.0 to 0.21.1
- build(deps-dev): bump @eslint/object-schema from 2.1.6 to 2.1.7
- refactor: Improve variable names in function to determine expired jobs
- test: Improve name of subtest for archiving
- test: Verify that archiving works regardless of logs/results present
- Dependency cron 2026-02-06
- Bump js-yaml from 4.1.0 to 4.1.1
- build(deps): bump ace-builds from 1.43.3 to 1.43.4
-
Update to version 5.1770308102.12dfd0e4:
- fix: Configure sudoers correctly in Leap 16
- Also use devel:openQA/16.0 in dependency bot workflow
- test: Consider all controller code covered
- refactor: Remove unused "group connect" endpoints
- test: Cover
openqa_jobs_by_workerfield of InfluxDB endpoint - test: Cover all cases of search of audit log table
- refactor: Simplify function to render audit log index page
- test: Add test for
eventidparameter of audit log page - test: Cover remaining lines of
Asset.pm
-
Update to version 5.1769644379.ef069e9d:
Changes in os-autoinst:
-
Update to version 5.1771353921.c8005c9:
- git subrepo pull (merge) --force external/os-autoinst-common
- style: Fix crop.py style issues
- workaround: Remove "get_mempolicy" warning from qemu-img output
- parse_extra_log: Allow passing additional args to upload_logs
- refactor: Distinguish tests by the script path in
loadtest - refactor: Simplify approach for avoiding redefine warnings
-
Update to version 5.1770715824.6a80a85:
- style: Fix crop.py style issues
- workaround: Remove "get_mempolicy" warning from qemu-img output
- parse_extra_log: Allow passing additional args to upload_logs
- refactor: Distinguish tests by the script path in
loadtest - refactor: Simplify approach for avoiding redefine warnings
- test: Allow running tests with
Test::Warnings<0.033 - test: Format test of
loadtestdirin a more compact way
-
Update to version 5.1770127521.c249fe9:
- refactor: Distinguish tests by the script path in
loadtest - refactor: Simplify approach for avoiding redefine warnings
- test: Allow running tests with
Test::Warnings<0.033 - test: Format test of
loadtestdirin a more compact way - test: Use
ENABLE_MODERN_PERL_FEATURES=1in test suite - feat: Allow enabling strict/warnings/signatures globally
- fix: Improve wrong comment about enablement of modern Perl features
- refactor: Distinguish tests by the script path in
Changes in openQA-devel-container:
- Update to version 5.1771422749.560a3b26b:
- Update to latest openQA version
Список пакетов
openSUSE Leap 16.0
Ссылки
- SUSE Security Ratings
- SUSE Bug 1257852
- SUSE CVE CVE-2026-25547 page
Описание
@isaacs/brace-expansion is a hybrid CJS/ESM TypeScript fork of brace-expansion. Prior to version 5.0.1, @isaacs/brace-expansion is vulnerable to a denial of service (DoS) issue caused by unbounded brace range expansion. When an attacker provides a pattern containing repeated numeric brace ranges, the library attempts to eagerly generate every possible combination synchronously. Because the expansion grows exponentially, even a small input can consume excessive CPU and memory and may crash the Node.js process. This issue has been patched in version 5.0.1.
Затронутые продукты
Ссылки
- CVE-2026-25547
- SUSE Bug 1257834