This update for google-osconfig-agent fixes the following issue:
- CVE-2026-63209: github.com/klauspost/compress: signed integer overflow in s2.NewDict() allows an attacker to bypass
repeat index validation and cause a process crash (bsc#1283672).
Changes for google-osconfig-agent:
Update to version 20260928.01
* scalibr linux new metadata support (#1038)
* Fix failing to report REBOOTING state during postPatchReboot
due to context canceled for Windows VMs (#1055)
* Fix os/snap extractor usage (#1053)
- Update github.com/klauspost/compress to v1.18.7
(bsc#1283672, CVE-2026-63209)
* bump grpc package to new version (#1057)
* bum
This update for google-osconfig-agent fixes the following issues:
- CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS
via oversized inputs (bsc#1276722).
- CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272118).
- CVE-2026-56854: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the crypto/ssh library (bsc#1278597).
- CVE-2026-56855: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the crypto/ssh library (bsc#1278597).
- CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and dea
This update for google-osconfig-agent fixes the following issues
- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation
bypass and privilege escalation (bsc#1266603).
- CVE-2026-56852: golang.org/x/text/unicode/norm: improper handling of input containing invalid UTF-8 bytes can lead
to infinite loop (bsc#1272118).
This update for google-osconfig-agent fixes the following issues:
- Update to version 20250416.02 (bsc#1244304, bsc#1244503)
* defaultSleeper: tolerate 10% difference to reduce test flakiness
* Add output of some packagemanagers to the testdata
- from version 20250416.01
* Refactor OS Info package
- from version 20250416.00
* Report RPM inventory as YUM instead of empty SoftwarePackage
when neither Zypper nor YUM are installed.
- from version 20250414.00
* Update hash computation algorithm
- Update to version 20250320.00
* Bump github.com/envoyproxy/protoc-gen-validate from 1.1.0 to 1.2.1
- from version 20250318.00
* Bump g
This update for google-osconfig-agent fixes the following issues:
- CVE-2025-22868: golang.org/x/oauth2/jws: Fixed unexpected memory consumption during token parsing (bsc#1239197)
This update for google-osconfig-agent fixes the following issues:
- CVE-2024-45339: github.com/golang/glog: a privileged process' log file path can be easily predicted and used to
overwrite other sensitive files in a system. (bsc#1236560)
This update for google-osconfig-agent fixes the following issues:
- Update to version 20250115.01 (bsc#1236406, bsc#1236407)
- CVE-2024-24790: Bump the golang compiler version to 1.22.4 (bsc#1225974)