bsc#1272310 bsc#1272311 bsc#1272312 bsc#1272313 bsc#1272317 bsc#1272318 bsc#1272319
Implementation note:
As I expect this kind of fixup may be needed again in the future, until
we iron out the workflow with the security team, here is my prompt to
gemini-cli used to make this change. I pasted the previous version of
the .changes entry and the bug list from the IBS PR.
Flash Lite was a bit confused, Pro did better.
---
In the following changelog fragment, note that some items are missing a Bugzilla.SUSE.com (bsc) reference.
- update runtime dependencies to:
- form-data 4.0.6, CVE-2025-7783 CVE-2026-12143 (bsc#1246822)
- react-router and react-router-dom 6.30.4, CVE-2026-40181
- update development dependencies to:
- @babel/core 7.29.7, CVE-2026-49356
- http-proxy-middleware 2.0.10, CVE-2026-55602
- js-yaml 4.3.0 and 3.15.0, CVE-2026-53550 (bsc#1268851)
- launch-editor 2.14.1, CVE-2026-53632
- shell-quote 1.10.0, CVE-2026-13311 (bsc#1269359)
- websocket-driver 0.7.5, CVE-2026-54490 CVE-2026-54466
- fast-uri 3.1.3, CVE-2026-13676 (bsc#1269595)
- brace-expansion 5.0.7, CVE-2026-13149 (bsc#1269927)
- updated on May 25 already, listing its references for tracking:
- underscore 1.13.8, CVE-2026-27601 (bsc#1259169)
Use the following list of new bsc entries, read them each using "curl -k https://fastzilla.suse.de/${BSC_ID}" and extract the corresponding CVE id and package name from the bug subject.
https://bugzilla.suse.com/show_bug.cgi?id=1272310https://bugzilla.suse.com/show_bug.cgi?id=1272311https://bugzilla.suse.com/show_bug.cgi?id=1272312https://bugzilla.suse.com/show_bug.cgi?id=1272313https://bugzilla.suse.com/show_bug.cgi?id=1272316https://bugzilla.suse.com/show_bug.cgi?id=1272317https://bugzilla.suse.com/show_bug.cgi?id=1272318https://bugzilla.suse.com/show_bug.cgi?id=1272319
Then output an updated changelog fragment, with the bsc references filled in. Also report on any mismatches (bsc without a changelog entry or vice versa)
ce77d3890b