CVE-2026-42506

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

These are all security issues fixed in the rclone-1.74.2-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the mcphost-0.34.0-8.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the yq-4.53.2-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the trivy-0.71.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the grafana-11.6.14+security04-3.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the velociraptor-0.7.0.4.git185.a5708584-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the gomuks-26.03+git.1780250926.564a8707-1.1 package on the GA media of openSUSE Tumbleweed.

This update for yq fixes the following issues:

Changes in yq:

• Fix multiple CVEs:

  • CVE-2026-27136 (GO-2026-5030) CVE-2026-25681 (GO-2026-5029) CVE-2026-25680 (GO-2026-5028) CVE-2026-42502 (GO-2026-5027) CVE-2026-42506 (GO-2026-5025) (bsc#1267053) CVE-2026-39821 (GO-2026-5026) (bsc#1267199)

• update to v4.53.2

  • Add system(command; args) operator (disabled by default).
  • TOML encoder: prefer readable table sections over inline tables.
  • Fix TOML encoder to quote keys containing special characters.
  • Add string slicing support.
  • Fix findInArray misuse on MappingNodes in equality and contains.
  • Fix panic on negative slice indices that underflow after adjustment.
  • Fix stack overflow from circular alias in traverse.
  • Fix panic and OOM in repeatString for large repeat counts.

• update to v4.52.5

  • Fix: reset TOML decoder state between files.
  • Fix: preserve original filename when using --front-matter.

• Integrate vulnchecker support into %check stage (optional: set %%_with_vulncheck 1).

• Fix CVE-2026-33814 (bsc#1266248):

  • update golang.org/x/net to v0.53.0.

• update to 4.52.4:

  • Dropping windows/arm - no longer supported in cross-compile
  • Fixing comments in TOML arrays
  • Bumped dependencies

• update to 4.52.2:

  • Fixed bad instructions file breaking go-install (#2587) Thanks @theyoprst
  • Fixed TOML table scope after comments (#2588) Thanks @tomers
  • Multiply uses a readonly context
  • Fixed merge globbing wildcards in keys
  • Fixing TOML subarray parsing issue

• update to 4.52.1:

  • TOML encoder support - you can now roundtrip! #1364
  • Parent now supports negative indices, and added a 'root' command for referencing the top level document
  • Fixed scalar encoding for HCL
  • Add --yaml-compact-seq-indent / -c flag for compact sequence indentation (#2583) Thanks @jfenal
  • Add symlink check to file rename util (#2576) Thanks @Elias- elastisys
  • Powershell fixed default command used for __completeNoDesc alias (#2568) Thanks @teejaded
  • Unwrap scalars in shell output mode. (#2548) Thanks @flintwinters
  • Added K8S KYAML output format support (#2560) Thanks @robbat2

• update to 4.50.1:

  • Added HCL Support - First cut - hopefully it works well!
  • Fixing handling of CRLF #2352

• update to 4.49.2:

  • Fixing escape character bugs :sweat: #2517
  • Fixing snap release pipeline #2518 Thanks @aalexjo

• update to 4.49.1:

  • Added --security flags to disable env and file ops #2515
  • Fixing TOML ArrayTable parsing issues #1758
  • Fixing parsing of escaped characters #2506

• update to 4.48.2:

  • Strip whitespace when decoding base64 #2507
  • Upgraded to go-yaml v4! (thanks @ccoVeille, @ingydotnet)
  • Add linux/loong64 to release target (thanks @znley)
  • Added --shell-key-separator flag for customizable shell output format #2497 (thanks @rsleedbx)

• update to 4.48.1:

  • Added 'parents' operator, to return a list of all the hierarchical parents of a node
  • Added 'first(exp)' operator, to return the first entry matching an expression in an array
  • Fixed xml namespace prefixes #1730 (thanks @baodrate)
  • Fixed out of range panic in yaml decoder #2460 (thanks @n471d)
  • Fixes CVE-2025-58190 (GO-2026-4441) (bsc#1251540) CVE-2025-47911 (GO-2026-4440) (bsc#1251339) by updating golang.org/x/net to v0.46.0.

• update to 4.47.2:

  • Conversion from TOML to JSON no longer omits empty tables #2459 (thanks @louislouislouislouis)

• update to 4.47.1:

  • Fixed merge anchor behaviour (<<); #2404, #2110, #2386, #2178 Huge thanks to @stevenwdv!

• Fix zsh completion location

• update to 4.46.1:

  • Added INI support
  • Fixed 'add' operator when piped in with no data #2378, #2383, #2384
  • Fixed delete after slice problem (bad node path) #2387 Thanks @antoinedeschenes
  • Fixed yq small build Thanks @imzue
  • Switched to YAML org supported go-yaml!

• update to 4.45.4:

  • Fixing…

This update for trivy fixes the following issues

• CVE-2026-25680,CVE-2026-25681,CVE-2026-27136,CVE-2026-42502,CVE-2026-42506: golang.org/x/net/html: multiple issues when parsing HTML files (bsc#1267047).
• CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265648).
• CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266495).
• CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh (bsc#1266075).
• CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266075).
• CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh (bsc#1266075).
• CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh (bsc#1266075).
• CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh (bsc#1266075).
• CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent (bsc#1266075).
• CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266075).
• CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266075).
• CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh (bsc#1266075).
• CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts (bsc#1266075).
• CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh (bsc#1266075).
• CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh (bsc#1266075).
• CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent (bsc#1266075).
• CVE-2026-44740: github.com/go-git/go-billy/v5: improper input handling in many components can lead to DoS via infinite loops, panics or resource consumption (bsc#1267268).

Changes for trivy:

• Update to version 0.71.0 (bsc#1267268, CVE-2026-44740):

• release: v0.71.0 [main] (#10638)
• ci: use only the first line of commit message in release-please workflow (#10766)
• feat: add WithDriver and WithProvider options to ospkg detector (#10740)
• chore(deps): bump github.com/google/go-containerregistry to v0.21.6 (#10741)
• refactor(secret): normalize configPath once in Init (#10702)
• feat(secret): add Maven rules to detect passwords and passphrases in settings.xml and settings-security.xml files (#10704)
• chore(deps): bump the common group across 1 directory with 25 updates (#10758)
• chore: migrate from gomodguard to gomodguard_v2 (#10739)
• chore(deps): bump the docker group across 1 directory with 2 updates (#10709)
• chore(deps): bump github.com/aws/aws-sdk-go-v2/service/ec2 from 1.302.0 to 1.303.0 in the aws group (#10752)
• ci: scope GitHub App tokens to minimum required permissions (#10755)
• chore(deps): upgrade go-redis from v8 to v9 (#10736)
• fix(misconf): fix rendering of nested values in terraform plan lists (#10746)
• fix(misconf): skip resources with no after changes (#10352)
• fix(misconf): reject nil plays during playbook parsing (#10273)
• fix(nodejs): silently skip subdirectory package.json files with invalid names (#10609)
• fix(misconf): skip null cty values in AsMapValue to prevent panic (#10723)
• refactor(misconf): replace custom Helm archive parsing with Helm SDK loaders (#10718)
• chore(deps): bump github.com/containerd/containerd/v2 to v2.3.1 (#10738)
• chore(deps): bump github.com/go-git/go-git/v5 from 5.19.0 to 5.19.1 (#10686)
• fix(report): don't produce trailing comma in gitlab.tpl links array (#10728)
• fix(cloudformation): propagate AWS::EC2::Instance MetadataOptions…

This update for neonmodem fixes the following issues:

Changes in neonmodem:

• Update golang.org/x/net dependency to v0.55.0 due to bsc#1267193

• Update golang.org/x/image dependency to v0.38.0 due to bsc#1260727

• Update golang.org/x/term dependency to v0.42.0 due to bsc#1260727

• Update to version 1.0.7+git0.346d1d3:

  • Update dependencies, remove debug output
  • Update GitHub actions
  • discourse: APi fixes
  • Bump golang.org/x/net from 0.36.0 to 0.38.0
  • Bump golang.org/x/net from 0.34.0 to 0.36.0
  • Update dependencies
  • Change chat button

• Add build option for position-independent executables

This update for grafana fixes the following issues:

Changes in grafana:

• Fix multiple issues when parsing HTML files (bsc#1267153): CVE-2026-25680, CVE-2026-42502, CVE-2026-27136, CVE-2026-25681, CVE-2026-42506

This update for mcphost fixes the following issues

• CVE-2026-25680,CVE-2026-25681,CVE-2026-27136,CVE-2026-42502,CVE-2026-42506: golang.org/x/net/html: multiple issues when parsing HTML files (bsc#1267109).
• CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265730).
• CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266572).
• CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh (bsc#1266145).
• CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266145).
• CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh (bsc#1266145).
• CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh (bsc#1266145).
• CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh (bsc#1266145).
• CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent (bsc#1266145).
• CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266145).
• CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266145).
• CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh (bsc#1266145).
• CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts (bsc#1266145).
• CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh (bsc#1266145).
• CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh (bsc#1266145).
• CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent (bsc#1266145).

This update for alloy fixes the following issues:

Update to version 1.17.0.

Security issues fixed:

• CVE-2026-25680: golang.org/x/net/html: parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service (bsc#1267185).
• CVE-2026-25681: golang.org/x/net/html: parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree and allows for XSS (bsc#1267185).
• CVE-2026-27136: golang.org/x/net/html: parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree and allows for XSS (bsc#1267185).
• CVE-2026-33532: yaml: parsing input with deeply nestes collections may throw a RangeError due to a stack overflow and cause to a denial of service (bsc#1260981).
• CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266654).
• CVE-2026-39827: golang.org/x/crypto/ssh: authenticated SSH clients that repeatedly open channels which were rejected by the server can cause unbounded memory growth and a crash (bsc#1266196).
• CVE-2026-39828: golang.org/x/crypto/ssh: permissions discarded when an SSH server authentication callback returns PartialSuccessError with non-nil permissions (bsc#1266196).
• CVE-2026-39829: golang.org/x/crypto/ssh: unenforced size limits on key parameters by the the RSA and DSA public key parsers can lead to excessive CPU consumption when processing a crafted public key (bsc#1266196).
• CVE-2026-39830: golang.org/x/crypto/ssh: malicious SSH peers sending unsolicited global request responses can block a connection's read loop and cause a resource leak (bsc#1266196).
• CVE-2026-39831: golang.org/x/crypto/ssh: missing User Presence flag checks in the Verify() method for FIDO/U2F security key types cause signatures generated without physical touch to be accepted (bsc#1266196).
• CVE-2026-39832: golang.org/x/crypto/ssh: destination restrictions are silently stripped when forwarding keys and allow for unrestricted use of a key on a remote host (bsc#1266196).
• CVE-2026-39833: golang.org/x/crypto/ssh: in-memory keyring returned by NewKeyring() silently accepts keys with the ConfirmBeforeUse constraint but never enforces it (bsc#1266196).
• CVE-2026-39834: golang.org/x/crypto/ssh: writing data larger than 4GB in a single Write call on an SSH channel leads to an integer overflow and an infinite loop that sends empty packets (bsc#1266196).
• CVE-2026-39835: golang.org/x/crypto/ssh: processing of certificates by SSH servers using CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority can lead to a panic (bsc#1266196).
• CVE-2026-41889: github.com/jackc/pgx/v5/internal/sanitize: use placeholders in dollar-quoted string literals in an SQL query can lead to a SQL injection (bsc#1265440).
• CVE-2026-42502: golang.org/x/net/html: parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree and allows for XSS (bsc#1267185).
• CVE-2026-42506: golang.org/x/net/html: parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree and allows for XSS (bsc#1267185).
• CVE-2026-42508: golang.org/x/crypto/ssh: revoked SignatureKeys belonging to a CA are not correctly checked for revocation (bsc#1266196).
• CVE-2026-44740: github.com/go-git/go-billy/v5: improper input handling in many components can lead to DoS via infinite loops, panics or resource consumption (bsc#1267333).
• CVE-2026-45678: go.opentelemetry.io/obi: Postgres BIND parsing can lead to a panic when malformed payloads are processed (bsc#1267481).
• CVE-2026-45682: go.opentelemetry.io/obi: keys not deleted by CappedConcurrentHashMap after removals allows repeated connection churn to grow the queue without bound and exhaust heap memory (bsc#1267485).
• CVE-2026-45685: go.opentelemetry.io/obi: MongoDB TCP parser panics on…

This update for hauler fixes the following issues:

Changes in hauler:

• update to 2.0.1 (bsc#1269433, CVE-2026-48702):

  • bump go to 1.26.4 to squash CVE noise
  • Full v2 Release notes: https://github.com/hauler- dev/hauler/releases/tag/v2.0.0

• update to 2.0.0:

  • v2.0.0 is a major release. It replaces Hauler's entire OCI plumbing... the ORAS v1 dependency and the in-house cosign fork with a native containerd based implementation, drops the deprecated v1alpha1 API, and layers on a meaningful set of new capabilities and reliability fixes on top of that new foundation.
  • Removed the ORAS v1 dependency - push/pull is now driven directly by containerd's docker resolver and google/go- containerregistry, new pkg/content/registry.go (RegistryTarget) and pkg/content/types.go (Target interface, IoContentWriter) replaces what ORAS used to own.
  • Removed the hauler-maintained cosign fork - pkg/cosign is now a thin verify only wrapper around upstream sigstore/cosign/v3. Images are added through a native s.AddImage() path in pkg/store
  • Added OCI 1.1 Referrers support - signatures, attestations, and SBOMs are discovered both via the classic cosign tag convention (sha256-.sig / .att / .sbom) and the modern Referrers API, then correctly through the OCI layout

• update x/net to v0.55.0 (bsc#1266602, CVE-2026-39821, bsc#1267150, CVE-2026-25680, CVE-2026-42502, CVE-2026-27136, CVE-2026-25681, CVE-2026-42506)

This update for cosign fixes the following issues

• CVE-2026-25680,CVE-2026-25681,CVE-2026-27136,CVE-2026-42502,CVE-2026-42506: multiple issues when parsing HTML files (bsc#1267044).
• CVE-2026-33815: memory-safety vulnerability (bsc#1261811).
• CVE-2026-39827,CVE-2026-39828,CVE-2026-39829,CVE-2026-39830,CVE-2026-39831,CVE-2026-39832,CVE-2026-39833,CVE-2026-39834,CVE-2026-39835,CVE-2026-42508,CVE-2026-46595,CVE-2026-46597,CVE-2026-46598: Fixed multiple issues in golang.org/x/crypto/ssh. (bsc#1266049).

This update for lux fixes the following issues:

Changes in lux:

• CVE-2026-25680, CVE-2026-42502, CVE-2026-27136, CVE-2026-25681, CVE-2026-42506: Issues when parsing HTML files (bsc#1267110)

• CVE-2024-45338: Denial of service due to non-linear parsing of case-insensitive content (bsc#1235304)

• CVE-2025-22872: Incorrectly interpreted tags can cause content to be placed wrong scope during DOM construction (bsc#1241766)

• CVE-2025-47911: Various algorithms with quadratic complexity when parsing HTML documents (bsc#1251460)

• CVE-2025-58190: Excessive memory consumption (bsc#1251627) Bump x/net to 0.57.0

• Update to 0.24.1:

  • ci: bump go version to 1.22 #1350

This update for rclone fixes the following issues:

Changes in rclone:

• Update to version 1.74.4 (boo#1267192):

  • Version v1.74.4
  • gui: update embedded release to 1.1.10
  • local: stop --links symlinks escaping the destination directory CVE-2026-54572
  • local: don't restore setuid/setgid/sticky bits from metadata by default GHSA-945v-v9p3-v5xw
  • s3: strip STS security token on same-host HTTPS->HTTP redirect GHSA-cf44-9pgv-m4xc
  • serve restic: fix --private-repos isolation bypass CVE-2026-59733
  • archive extract: fix path traversal letting archives escape the destination CVE-2026-59732
  • serve s3: fix path traversal letting clients see files in the root GHSA-8v25-v8p6-qf7v
  • build: fix multiple CVEs by upgrading to go1.26.5
  • s3: fix mounting a prefix failing with 403 when HEAD is not permitted
  • drive, googlephotos: warn when using rclone's shared client_id #9580
  • drive: fix stray %!(EXTRA) in unexportable google document log message
  • serve/http: fix --disable-zip so it works over rc
  • serve webdav: fix MOVE overwrite failing without Overwrite header
  • fs: fix negative offset when a suffix Range request exceeds object size
  • accounting: fix goroutine leak in NewStatsGroup for zero-transfer rc jobs
  • cmd/mount2: fix NFS directory listings by supporting non-zero Seekdir offsets
  • cmd/mount2: fix ESTALE over NFS by reporting stable inode numbers
  • cmd/mount2: fix NFS file creation by implementing Mknod
  • smb: fix for IBM iSeries and signature verification
  • mega: fix hard deleted files reappearing in listings - fixes #9554
  • mega: wait for server events after upload, delete and move
  • vfs: fix hang reopening a file during the handle-caching grace period
  • s3: correct documented copy_cutoff minimum to 1 byte - Fixes #7391
  • fs: fix command line flag being ignored when set to its default value
  • docs: fix copy to clipboard functionality for code blocks
  • fs/operations: correct DeleteFile --backup-dir documentation
  • build: update golang.org/x/image to v0.43.0 to fix image decoding vulnerabilities
  • docs: clarify copyto command description - Fixes #9527
  • docs: fix typo in remote setup docs
  • serve s3: fix spurious 404 on HEAD/GET during VFS writeback - fixes #8188
  • • s3: fix error mapping in GetObject to match HeadObject
  • filter: fix --files-from copy stopping at the first unreadable file
  • docs: Fix RELEASE.md
  • ncdu: fix duplicated keystrokes on Windows by pinning tcell to v2.9.0
  • completion: fix powershell completion corrupting non-ASCII names - fixes #9412
  • docs/crypt: fix encrypted size example - Fixes #9202
  • docs: drive: note Google verification exemption for personal use apps
  • rc: document that rc API access is equivalent to shell access
  • docs: drive: update documentation about "Computers" folder
  • accounting: fix goroutine leak in ResetCounters
  • docs: fix --windows-event-log-level help
  • backend/filelu: fix recursive listing path handling and file filtering
  • docs: bisync - clarify flag interaction and minor changes
  • docs: Update RELEASE.md to use cherry-pick -x
  • webdav: fix mixed property statuses in multi-status responses
  • s3: remove session token on cross-host redirects
  • drive: warn when non-exportable Google documents are skipped - #9475
  • Start v1.74.4-DEV development

• update x/image to 0.43 (bsc#1271056)

• Update to version 1.74.3: (boo#1267869)

  • Bug Fixes
    • rc
      • Fix unauthenticated command execution via --rc-serve inline remotes CVE-2026-49980 (Nick Craig-Wood)
      • Stop global.* connection string options changing config CVE-2026-49980 (Nick Craig-Wood)
    • build: Fix multiple CVEs by upgrading to go1.26.4 (Nick Craig-Wood)
      • CVE-2026-42504: mime: quadratic complexity in WordDecoder.DecodeHeader
      • CVE-2026-42507: net/textproto: arbitrary input are included in errors without any escaping
      • CVE-2026-27145: crypto/x509: split…

This update for govulncheck-vulndb fixes the following issues:

• Update to version 0.0.20260723T184607 2026-07-23T18:46:07Z (jsc#PED-11136).

Go CVE Numbering Authority IDs added or updated with aliases:

• GO-2026-4730 CVE-2026-33022 GHSA-cv4x-93xx-wgfj
• GO-2026-4761 CVE-2026-33211 GHSA-j5q5-j9gm-2w5c
• GO-2026-5102 CVE-2026-45021 GHSA-3vcp-chfh-f6r2
• GO-2026-5272 CVE-2026-40938 GHSA-94jr-7pqp-xhcq
• GO-2026-5486 CVE-2026-40924 GHSA-m2cx-gpqf-qf74
• GO-2026-5542 CVE-2026-40090 GHSA-pj97-4p9w-gx3q
• GO-2026-5630 CVE-2026-25542 GHSA-rmx9-2pp3-xhcr
• GO-2026-5643 CVE-2026-40923 GHSA-rx35-6rhx-7858
• GO-2026-5675 CVE-2026-41492 GHSA-vvf7-6rmr-m29q
• GO-2026-5711 CVE-2026-40161 GHSA-wjxp-xrpv-xpff
• GO-2026-5746 CVE-2026-41567 GHSA-x86f-5xw2-fm2r
• GO-2026-5749 CVE-2026-41328 GHSA-x92x-px7w-4gx4
• GO-2026-5837 CVE-2026-44840 GHSA-q2m9-6jp9-c6mc
• GO-2026-5929 CVE-2026-44342 GHSA-26v7-h57m-gh9m
• GO-2026-5930 CVE-2026-33655 GHSA-6qcr-qxgr-m7fv
• GO-2026-5933 GHSA-3g4q-2f67-2gvh
• GO-2026-5934 GHSA-59qp-cfj3-rp64
• GO-2026-5935 GHSA-7856-g3gv-9wq8
• GO-2026-5936 CVE-2026-53552 GHSA-26rh-24rg-j3vv
• GO-2026-5937 CVE-2026-53508 GHSA-2jcc-mxv7-p3f9
• GO-2026-5938 CVE-2026-53553 GHSA-4g5x-hcwm-82jw
• GO-2026-5939 CVE-2026-10517 GHSA-698x-9w2p-7vvp
• GO-2026-5940 CVE-2026-53572 GHSA-6w3m-4hhp-775q
• GO-2026-5941 CVE-2026-53487 GHSA-gvhc-wv3v-7pf8
• GO-2026-5942 CVE-2026-46600
• GO-2026-5944 CVE-2026-50197 GHSA-659f-rgp5-w4wf
• GO-2026-5945 CVE-2026-6815 GHSA-rmxx-v9rj-vpvg
• GO-2026-5946 CVE-2026-52831 GHSA-v5px-423j-pf7p
• GO-2026-5947 CVE-2026-53649 GHSA-xqhv-chqm-fhcc
• GO-2026-5948 CVE-2026-50554 GHSA-588f-fvcv-xhvf
• GO-2026-5949 CVE-2026-50553 GHSA-rqrh-8wpv-x7hh
• GO-2026-5950 CVE-2026-53602 GHSA-339v-266x-79xr
• GO-2026-5951 CVE-2026-10219 GHSA-6jm8-4fhr-5w64
• GO-2026-5952 CVE-2026-49834 GHSA-9vcr-p3rj-q5q6
• GO-2026-5953 CVE-2026-9094 GHSA-c9w5-qp6m-m395
• GO-2026-5956 CVE-2026-55252 GHSA-h5g6-xmh4-hc37
• GO-2026-5957 CVE-2026-54158 GHSA-5xfx-xj4h-5p7r
• GO-2026-5958 CVE-2026-54068 GHSA-gcm7-57gf-953c
• GO-2026-5959 CVE-2026-54072 GHSA-h29v-hj44-q8cv
• GO-2026-5961 CVE-2026-54069 GHSA-hvr9-72v2-fff3
• GO-2026-5962 CVE-2026-54088 GHSA-m93h-4hw7-5qcm
• GO-2026-5963 CVE-2026-54067 GHSA-mvjr-vv3c-w4qv
• GO-2026-5964 CVE-2026-54066 GHSA-p4m3-mgmm-c664
• GO-2026-5965 CVE-2026-54070 GHSA-w7cg-whh7-xp28
• GO-2026-5966 CVE-2026-54089 GHSA-xqp3-jq6g-x3qm
• GO-2026-5967 CVE-2026-50551 GHSA-56mp-4f3v-fgj2
• GO-2026-5968 CVE-2026-54174 GHSA-fpg8-7664-jc5q
• GO-2026-5969 GHSA-g936-7jqj-mwv8
• GO-2026-5970 CVE-2026-56852
• GO-2026-5973 CVE-2026-54250 GHSA-jxr7-mqhw-9p98
• GO-2026-5974 CVE-2026-44300 GHSA-wmj8-9953-vff5
• GO-2026-5975 CVE-2026-50018 GHSA-42j2-w334-qxw7
• GO-2026-5976 CVE-2026-50141 GHSA-g7mm-9vx7-jm7h
• GO-2026-5977 CVE-2026-50013 GHSA-qrh4-p6v4-mrfg
• GO-2026-5978 CVE-2026-50125 GHSA-qw5r-ppcg-f8rj
• GO-2026-5979 CVE-2026-50006 GHSA-xrcf-6jh3-ggvx
• GO-2026-5980 CVE-2026-50158 GHSA-2c7f-fxww-6w6c
• GO-2026-5981 GHSA-mqxv-9rm6-w8qc
• GO-2026-5982 GHSA-pqg7-v6wh-3pfp
• GO-2026-5984 CVE-2026-53604 GHSA-2p2f-px33-4vv5
• GO-2026-5985 GHSA-7rx3-5wx3-5v76
• GO-2026-5986 CVE-2026-61699 GHSA-cm26-5974-52h8
• GO-2026-5987 CVE-2026-55513 GHSA-g4x6-jcvr-9m3g
• GO-2026-5988 CVE-2026-54628 GHSA-hwrq-8wxh-q4xv
• GO-2026-5989 CVE-2026-55512 GHSA-m3cx-mwpg-32jg
• GO-2026-5990 CVE-2026-54629 GHSA-mf78-3rpf-r784
• GO-2026-5991 CVE-2026-53603 GHSA-q4vm-pq3q-8wgq
• GO-2026-5992 CVE-2026-61549 GHSA-qf34-295c-26v8
• GO-2026-5996 CVE-2026-54450 GHSA-pph6-vfjv-vpjw
• GO-2026-5997 CVE-2026-54452 GHSA-xgch-x3mx-cm3c
• GO-2026-5998 CVE-2026-54495 GHSA-398h-7f66-3h4p
• GO-2026-5999 CVE-2026-10814 GHSA-jh6h-v6mp-h22v
• GO-2026-6002 CVE-2026-58196 GHSA-pr64-jmmf-jp54
• GO-2026-6003 CVE-2026-53714 GHSA-22xc-xg2r-9j7v
• GO-2026-6004 CVE-2026-52833 GHSA-3v79-m2cg-89ww
• GO-2026-6005 CVE-2026-53715 GHSA-8fv2-88gg-hm7q
• GO-2026-6006 CVE-2026-53716 GHSA-cxpq-8v7q-cg56 *…