{"id":"openSUSE-SU-2026:21185-1","summary":"Security update for stgit","details":"This update for stgit fixes the following issues:\n\nChanges in stgit:\n\n- Update to version 2.6.0:\n  * chore: update changelog for 2.6.0\n  * fix(import): respect --name verbatim, ignoring stgit.namelength\n  * test(refresh): use test_when_finished for status.renames cleanup\n  * expect over unwrap for test\n  * bugfix: issue #615, add Copied variant to Status enum and move panic to a copied status, add integration test\n  * docs: Update copyright year\n  * chore: update gix to 0.83 (CVE-2026-40034, bsc#1266429)\n  * chore: update compatible transitive dependencies\n  * chore: update winnow to 1.0.3\n  * chore: update jiff to 0.2.24\n  * ci: drop dead CARGO_TARGET_*_STRIP env vars from package build\n  * ci: soft-pin cargo-deb to ^3.0\n  * ci: bump cargo-generate-rpm pin to ^0.20.0\n  * ci: bump GitHub Actions to Node 24 runtimes\n  * chore: update winnow to 1.0.1\n  * chore: update clap to 4.6.1\n  * chore: update gix to 0.81\n  * chore: bump MSRV to 1.85\n  * chore: update transitive deps\n  * chore: update winnow to 0.7.15\n  * chore: update thiserror to 2.0.18\n  * chore: update tempfile to 3.27.0\n  * chore: update tar to 0.4.45\n  * chore: update serde_json to 1.0.149\n  * chore: update jiff to 0.2.23\n  * chore: update indexmap to 2.14.0\n  * chore: update flate2 to 1.1.9\n  * chore: update ctrlc to 3.5.2\n  * chore: update clap to 4.5.61\n  * chore: update anyhow to 1.0.102\n  * chore: update anstyle to 1.0.14\n\n- Update to version 2.5.5:\n  * fix(squash): keep author when squashed commits have same author\n\n- Update to version 2.5.4:\n  * chore: update changelog for 2.5.4\n  * chore: update transitive dependencies\n  * chore: update clap to 4.5.43\n  * refactor: clippy fixes\n  * fix: gix 0.73 breaking changes\n  * chore: update gix to 0.73\n  * chore: update transitive dependencies\n  * chore: update serde_json to 1.0.142\n  * chore: update winnow to 0.7.12\n  * chore: update clap to 4.5.42\n  * refactor: clippy lints\n  * stgit.el: Use `with-eval-after-load' instead of a homemade version\n  * stgit.el: Use `advice-add' instead of `defadvice'\n  * stgit.el: Fix various checkdoc warnings\n  * stgit.el: Support Emacs versions \u003c 31\n  * feat(bash): complete patches from chosen branch\n  * chore: update dependencies\n  * refactor: repair clippy lints\n  * chore: update clap to 4.5.40\n  * chore: update anstyle to 1.0.11\n  * chore: update winnow to 0.7.11\n  * chore: update anyhow to 1.0.98\n  * chore: update jiff to 0.2.15\n  * chore: update tempfile to 3.20.0\n  * chore: update curl to 0.4.48\n  * chore: update flate2 to 1.1.2\n  * chore: update ctrlc to 3.4.7\n  * chore(deps): bump winnow from 0.7.6 to 0.7.10\n  * chore(deps): bump clap from 4.5.36 to 4.5.39\n  * docs: Update copyright year\n  * chore: update transitive dependencies\n  * chore: update tempfile to 3.19.1\n  * chore: update jiff to 0.2.6\n  * chore: update winnow to 0.7.6\n  * chore: update gix to 0.71\n  * chore: update indexmap to 2.9.0\n  * chore: update is-terminal to 0.4.16\n  * chore: update ctrlc to 3.4.6\n  * chore: update bstr to 1.12.0\n  * chore: update clap to 4.5.36\n  * chore: update flate2 to 1.1.1\n  * chore: update serde to 1.0.219\n  * chore: update serde_json to 1.0.140\n  * chore: update thiserror to 2.0.12\n  * chore: update anyhow to 1.0.97\n  * refactor: repair clippy lint\n  * stgit.el: Move 'stgit-patch-status-face-alist' before first use\n  * stgit.el: Silence warnings of missing vc variables\n  * stgit.el: Replace ad-hoc `make-local-variable' with `defvar-local'\n  * stgit.el: Use defvar-local instead of make-local-variable\n  * stgit.el: Enable lexical-binding\n  * stgit.el: Allow empty descriptions\n  * stgit.el: Add \"--no-color\" flag to 'git log' and 'git show'\n  * stgit.el: Pass patch into `stgit-process-files'\n  * chore: update changelog for 2.5.3\n  * chore: update dependencies\n  * refactor(stgit.el): use space-based indentation consistently\n  * refactor: repair clippy lint\n  * chore(deps): bump tempfile from 3.16.0 to 3.17.0\n  * chore(deps): bump jiff from 0.2.0 to 0.2.1\n  * build: statically linked packages for riscv64\n  * chore: update changelog for 2.5.2\n  * chore: update jiff to 0.2.0\n  * chore: update winnow to 0.7.2\n  * fix: partial_ref_name\n  * chore: resolve winnow deprecations\n  * chore: update dependencies\n  * ci: disable test for windows build\n  * chore(deps): bump jiff from 0.1.24 to 0.1.29\n  * chore(deps): bump serde_json from 1.0.135 to 1.0.138\n  * chore(deps): bump is-terminal from 0.4.13 to 0.4.15\n  * chore(deps): bump indexmap from 2.7.0 to 2.7.1\n  * chore(deps): bump clap from 4.5.26 to 4.5.28\n  * stgit.el: Fix various compile warnings\n  * stgit.el: Replace depercated cl function calls with new style\n  * stgit.el: Fix some checkdoc warnings\n  * stgit.el: Fix emacs pre-pending \"Summary: \" to log-edit buffers\n  * chore: update changelog for 2.5.1\n  * chore: update release checklist\n  * ci: use ubuntu-24.04 image\n  * fix: assure branch creation respects fetch-specs of remotes. (#522)\n  * chore: update to latest `gix` for improved API (#522)\n  * chore: update transitive deps\n  * chore: update anstyle-wincon to 3.0.7\n  * chore: update bitflags to 2.8.0\n  * chore: update jiff to 0.1.24\n  * chore: update transitive deps\n  * chore: update syn to 2.0.96\n  * chore: update bitflags to 2.7.0\n  * chore: update clap to 4.5.26\n  * chore: update serde_json to 1.0.135\n  * chore: update thiserror to 2.0.11\n  * chore: update winnow to 0.6.24\n  * refactor: repair clippy lints for is_some_and\n  * test: repair regression with git v2.48\n  * chore(deps): bump jiff from 0.1.18 to 0.1.21\n  * chore(deps): bump bstr from 1.11.1 to 1.11.3\n  * chore(deps): bump tempfile from 3.14.0 to 3.15.0\n  * chore: update changelog for 2.5.0\n  * chore: update transitive deps\n  * chore: update windows-sys to 0.59.0\n  * chore: update serde to 1.0.217\n  * chore: update winnow to 0.6.21\n  * chore: update jiff to 0.1.18\n  * docs: explain stgit.autosign a bit better\n  * feat: new \"name\" subcommand\n  * feat: organize subcommands by group in help\n  * chore: fix warning\n  * feat: support calling stg rebase without arguments\n  * tests: add test for rebase without arguments\n  * chore: update dependencies\n  * chore: update serde_json to 1.0.134\n  * chore: update thiserror to 2.0.9\n  * chore: update anyhow to 1.0.95\n  * chore: update gix to 0.69\n  * chore: update changelog for 2.4.13\n  * chore: update transitive deps\n  * chore: update jiff to 0.1.15\n  * chore: update gix to 0.68\n  * chore: update flate2 to 1.0.35\n  * chore: update serde to 1.0.216\n  * chore: update thiserror to 2.0.7\n  * chore: update indexmap to 2.7.0\n  * chore: update clap to 4.5.23\n  * chore: update bstr to 1.11.1\n  * chore: update anyhow to 1.0.94\n  * refactor: repair clippy lints\n  * chore: update thiserror to 2.0.3\n  * chore: update allocator-api2 to 0.2.19\n  * chore: update url to 2.5.3\n  * chore: update cc to 1.1.37\n  * chore: update anstream to 0.6.18\n  * chore: update fastrand to 2.2.0\n  * chore: update libc to 0.2.162\n  * chore: update curl-sys to 0.4.78+curl-8.11.0\n  * chore: update tempfile to 3.14.0\n  * chore: update anyhow to 1.0.93\n  * chore: update gix to 0.67.0\n  * chore: update autocfg to 1.4.0\n  * chore: update unicode-bidi to 0.3.17\n  * chore: update unicode-ident to 1.0.13\n  * chore: update redox_syscall to 0.5.7\n  * chore: update colorchoice to 1.0.3\n  * chore: update anstyle-query to 1.1.2\n  * chore: update anstyle-parse to 0.2.6\n  * chore: update proc-macro2 to 1.0.89\n  * chore: update unicode-normalization to 0.1.24\n  * chore: update gix-quote to 0.4.13\n  * chore: update gix-bitmap to 0.2.12\n  * chore: update gix-config-value to 0.14.9\n  * chore: update memmap2 to 0.9.5\n  * chore: update gix-chunk to 0.4.9\n  * chore: update pkg-config to 0.3.31\n  * chore: update cc to 1.1.34\n  * chore: update anstream to 0.6.17\n  * chore: update rustix to 0.38.38\n  * chore: update once_cell to 1.20.2\n  * chore: update gix-validate to 0.9.1\n  * chore: update gix-utils to 0.1.13\n  * chore: update gix-sec to 0.10.9\n  * chore: update gix-date to 0.9.1\n  * chore: update gix-command to 0.3.10\n  * chore: update schannel to 0.1.26\n  * chore: update openssl-sys to 0.9.104\n  * chore: update libc to 0.2.161\n  * chore: update regex-automata to 0.4.8\n  * chore: update winnow to 0.6.20\n  * chore: update thiserror to 1.0.67\n  * chore: update tempfile to 3.13.0\n  * chore: update tar to 0.4.43\n  * chore: update serde_json to 1.0.132\n  * chore: update serde to 1.0.214\n  * chore: update jiff to 0.1.14\n  * chore: update indexmap to 2.6.0\n  * chore: update flate2 to 1.0.34\n  * chore: update encoding_rs to 0.8.35\n  * chore: update curl to 0.4.47\n  * chore: update clap to 4.5.20\n  * chore: update anyhow to 1.0.92\n  * chore: update anstyle to 1.0.10\n\n- Update to 2.5.4\n  * stgit.el: Use with-eval-after-load instead of a homemade version\n  * stgit.el: Use advice-add instead of defadvice\n  * stgit.el: Fix various checkdoc warnings\n  * stgit.el: Support Emacs versions \u003c 31\n  * stgit.el: Move 'stgit-patch-status-face-alist' before first use\n  * stgit.el: Silence warnings of missing vc variables\n  * stgit.el: Replace ad-hoc make-local-variable with defvar-local\n  * stgit.el: Use defvar-local instead of make-local-variable\n  * stgit.el: Enable lexical-binding\n  * stgit.el: Allow empty descriptions\n  * stgit.el: Add \"--no-color\" flag to 'git log' and 'git show'\n  * stgit.el: Pass patch into stgit-process-files\n  * chore: update gix to 0.73\n  * docs: Update copyright year\n  * feat(bash): complete patches from chosen branch\n\n- Update to 2.5.3\n  * build: statically linked packages for riscv64\n  * chore: update dependencies\n  * refactor(stgit.el): use space-based indentation consistently\n\n- Update to 2.5.2 2025-02-16\n  * fix(stgit.el): various compile warnings\n  * fix(stgit.el): Replace depercated cl function calls with new style\n  * fix(stgit.el): checkdoc warnings\n  * fix(stgit.el): emacs pre-pending \"Summary: \" to log-edit buffers\n  * chore: update jiff to 0.2.0\n  * chore: update winnow to 0.7.2\n  * chore: resolve winnow deprecations\n  * chore: update dependencies\n\n- Update to 2.5.1 2025-01-18\n  * fix: assure branch creation respects fetch-specs of remotes (#522)\n  * ci: ubuntu-24.04 is now used to build release binaries\n  * chore: gix is updated to 0.70\n\n- Update to 2.5.0 2025-01-01\n  * feat: new \"name\" subcommand\n  * feat: support calling stg rebase without arguments\n  * docs: explain stgit.autosign a bit better\n  * feat: organize subcommands by group in help\n\n- Update to 2.4.13\n  * fix(squash): preserve consensus author\n  * chore: update gix to 0.68\n","modified":"2026-07-02T18:24:16.686367215Z","published":"2026-06-30T15:11:42Z","related":["CVE-2026-40034"],"upstream":["CVE-2026-40034"],"references":[{"type":"ADVISORY"},{"type":"REPORT","url":"https://bugzilla.suse.com/1266429"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-40034"}],"affected":[{"package":{"name":"stgit","ecosystem":"openSUSE:Leap 16.0","purl":"pkg:rpm/opensuse/stgit&distro=openSUSE%20Leap%2016.0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0-bp160.1.1"}]}],"ecosystem_specific":{"binaries":[{"stgit-emacs":"2.6.0-bp160.1.1","stgit-fish-completion":"2.6.0-bp160.1.1","stgit-vim-plugin":"2.6.0-bp160.1.1","stgit-zsh-completion":"2.6.0-bp160.1.1","stgit":"2.6.0-bp160.1.1","stgit-bash-completion":"2.6.0-bp160.1.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:21185-1.json"}}],"schema_version":"1.7.5"}