[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-OPENSUSE-SU-2026:21262-1":6},{"stargazers_count":4,"fetched_at":5},8,"2026-09-19T11:35:27.363Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":11,"aliases":12,"duplicate_of":9,"upstream":13,"downstream":26,"duplicates":27,"related":28,"reserved_at":9,"published_at":35,"modified_at":36,"state":9,"summary":37,"references_raw":39,"kevs":75,"epss":9,"epss_history":76,"metrics":77,"affected":78},"OPENSUSE-SU-2026:21262-1","Security update for hauler\n\nThis update for hauler fixes the following issues:\n\nChanges in hauler:\n\n- update to 2.0.1 (bsc#1269433, CVE-2026-48702):\n  * bump go to 1.26.4 to squash CVE noise\n  * Full v2 Release notes: https://github.com/hauler-\n    dev/hauler/releases/tag/v2.0.0\n\n- update to 2.0.0:\n  * `v2.0.0` is a **major** release. It replaces Hauler's entire\n    OCI plumbing... the ORAS v1 dependency and the in-house\n    cosign fork with a native containerd based implementation,\n    drops the deprecated `v1alpha1` API, and layers on a\n    meaningful set of new capabilities and reliability fixes on\n    top of that new foundation.\n  * **Removed the ORAS v1 dependency** - push/pull is now driven\n    directly by containerd's docker resolver and `google/go-\n    containerregistry`, new `pkg/content/registry.go`\n    (`RegistryTarget`) and `pkg/content/types.go` (`Target`\n    interface, `IoContentWriter`) replaces what ORAS used to own.\n  * **Removed the hauler-maintained cosign fork** - `pkg/cosign`\n    is now a thin verify only wrapper around upstream\n    `sigstore/cosign/v3`. Images are added through a native\n    `s.AddImage()` path in `pkg/store`\n  * **Added OCI 1.1 Referrers support** - signatures,\n    attestations, and SBOMs are discovered both via the classic\n    cosign tag convention (`sha256-.sig` / `.att` / `.sbom`) and\n    the modern Referrers API, then correctly through the OCI\n    layout\n\n- update x/net to v0.55.0 (bsc#1266602, CVE-2026-39821,\n     bsc#1267150, CVE-2026-25680, CVE-2026-42502, CVE-2026-27136,\n     CVE-2026-25681, CVE-2026-42506)\n",null,[],[],[],[14,16,18,20,22,24],{"_key":15},"CVE-2026-25680",{"_key":17},"CVE-2026-25681",{"_key":19},"CVE-2026-27136",{"_key":21},"CVE-2026-42502",{"_key":23},"CVE-2026-42506",{"_key":25},"CVE-2026-48702",[],[],[29,30,31,32,33,34],{"_key":15},{"_key":17},{"_key":19},{"_key":21},{"_key":23},{"_key":25},"2026-07-06T09:02:35Z","2026-07-09T18:24:13.951698752Z",{"cisa_kev":38,"cisa_ransomware":38,"cisa_vendor":9,"epss_severity":9,"epss_score":9,"severity":9,"severity_score":9,"severity_version":9,"severity_source":9,"severity_vector":9,"severity_status":9},false,[40,46,50,55,59,63,67,71],{"url":41,"sources":42,"tags":44},"https://bugzilla.suse.com/1267150",[43],"osv_opensuse",[45],"REPORT",{"url":47,"sources":48,"tags":49},"https://bugzilla.suse.com/1269433",[43],[45],{"url":51,"sources":52,"tags":53},"https://www.suse.com/security/cve/CVE-2026-25680",[43],[54],"WEB",{"url":56,"sources":57,"tags":58},"https://www.suse.com/security/cve/CVE-2026-25681",[43],[54],{"url":60,"sources":61,"tags":62},"https://www.suse.com/security/cve/CVE-2026-27136",[43],[54],{"url":64,"sources":65,"tags":66},"https://www.suse.com/security/cve/CVE-2026-42502",[43],[54],{"url":68,"sources":69,"tags":70},"https://www.suse.com/security/cve/CVE-2026-42506",[43],[54],{"url":72,"sources":73,"tags":74},"https://www.suse.com/security/cve/CVE-2026-48702",[43],[54],[],[],[],[79],{"ecosystem":80,"name":81,"vendor":82,"product":83,"cpe_part":9,"purl_type":84,"purl_namespace":82,"purl_name":83,"source":9,"versions":85},"openSUSE","hauler","opensuse","hauler&distro=openSUSE Leap 16.0","rpm",[86],{"version":87,"is_range":88,"range_type":89,"version_start":9,"version_start_type":9,"version_end":90,"version_end_type":91,"fixed_in":9},"lt2_0_1_bp160_1_1",true,"ecosystem","2.0.1-bp160.1.1","excluding"]