Skip to content

fix(buck2): Remediate GHSA-rhfx-m35p-ff5j by bumping lru#77957

Merged
Ankush-Pathak merged 1 commit into
wolfi-dev:mainfrom
Ankush-Pathak:buck2/GHSA-rhfx-m35p-ff5j
Jan 13, 2026
Merged

fix(buck2): Remediate GHSA-rhfx-m35p-ff5j by bumping lru#77957
Ankush-Pathak merged 1 commit into
wolfi-dev:mainfrom
Ankush-Pathak:buck2/GHSA-rhfx-m35p-ff5j

fix(buck2): Remediate GHSA-rhfx-m35p-ff5j by bumping lru

f296f4a
Select commit
Loading
Failed to load commit list.
Octo STS / ci-diff-report succeeded Jan 13, 2026 in 0s

Package diff

Package diff

Details

Package Diffs

aarch64/buck2-20260102-r0.apk -> aarch64/buck2-20260102-r1.apk

📦 Package diff:

  &apk.Package{
  	Name:        "buck2",
- 	Version:     "20260102-r0",
+ 	Version:     "20260102-r1",
  	Arch:        "aarch64",
  	Description: "Build system, successor to Buck",
  	... // 2 identical fields
  	Maintainer: "wolfi",
  	URL:        "",
  	Checksum: []uint8{
- 		0x1f, 0xae, 0x9c, 0xa8, 0xc4, 0xd9, 0x88, 0x82, 0x24, 0xba, 0x84, 0x1e, 0x60, 0x1b, 0x19, 0x6d, // -|........$...`..m|
- 		0xb3, 0x65, 0xdc, 0xaf,                                                                         // -|.e..|
+ 		0x53, 0x89, 0x3f, 0x26, 0x23, 0x37, 0x7b, 0x4c, 0x13, 0xa9, 0x7b, 0xb6, 0x64, 0xa7, 0x29, 0xf1, // +|S.?&#7{L..{.d.).|
+ 		0x4f, 0x69, 0x4e, 0xcf,                                                                         // +|OiN.|
  	},
  	Dependencies:     {"so:ld-linux-aarch64.so.1", "so:libc.so.6", "so:libgcc_s.so.1", "so:libm.so.6"},
- 	Provides:         []string{"cmd:buck2=20260102-r0"},
+ 	Provides:         []string{"cmd:buck2=20260102-r1"},
  	InstallIf:        nil,
- 	Size:             49500465,
+ 	Size:             49488352,
- 	InstalledSize:    141097256,
+ 	InstalledSize:    141214236,
  	ProviderPriority: 0,
- 	BuildTime:        s"2026-01-02 20:30:24 +0000 UTC",
+ 	BuildTime:        s"2026-01-13 06:47:10 +0000 UTC",
- 	BuildDate:        1767385824,
+ 	BuildDate:        1768286830,
  	RepoCommit: strings.Join({
- 		"f97450174ff20bb21fcddac7194ce62e3d9f6a9",
+ 		"13df0b36727e6d46f87a36183b76cb4601aff83",
  		"4",
  	}, ""),
  	Replaces: nil,
  	DataHash: "",
  }

➕ Added:

  • var/lib/db/sbom/buck2-20260102-r1.spdx.json (644)

➖ Removed:

  • var/lib/db/sbom/buck2-20260102-r0.spdx.json (644)

🔺 Changed:

.melange.yaml
- -rw-r--r-- 11859 2026-01-02 20:30:24 .melange.yaml
+ -rw-r--r-- 12064 2026-01-13 06:47:10 .melange.yaml
usr/bin/buck2
- -rwxr-xr-x 140044384 2026-01-02 20:30:24 buck2
-   APK-TOOLS.checksum.SHA1: "6e26c28549d3815624434b95af17bd5983fb9634"
+ -rwxr-xr-x 140159736 2026-01-13 06:47:10 buck2
+   APK-TOOLS.checksum.SHA1: "06c9cf304504a05da6e3df95d24d238890c08e29"

x86_64/buck2-20260102-r0.apk -> x86_64/buck2-20260102-r1.apk

📦 Package diff:

  &apk.Package{
  	Name:        "buck2",
- 	Version:     "20260102-r0",
+ 	Version:     "20260102-r1",
  	Arch:        "x86_64",
  	Description: "Build system, successor to Buck",
  	... // 2 identical fields
  	Maintainer: "wolfi",
  	URL:        "",
  	Checksum: []uint8{
- 		0x67, 0xd1, 0x15, 0x24, 0x2d, 0x1f, 0xd9, 0xe6, 0x5f, 0xc1, 0xd3, 0xdb, 0xc0, 0x71, 0xfa, 0x19, // -|g..$-..._....q..|
- 		0x68, 0x16, 0xad, 0xaf,                                                                         // -|h...|
+ 		0x6c, 0xb3, 0xf6, 0x76, 0xf4, 0xe0, 0xc8, 0x64, 0x5c, 0x2a, 0x42, 0x90, 0xc2, 0xe3, 0xf5, 0xda, // +|l..v...d\*B.....|
+ 		0xc1, 0x83, 0x3d, 0xc4,                                                                         // +|..=.|
  	},
  	Dependencies:     {"so:ld-linux-x86-64.so.2", "so:libc.so.6", "so:libgcc_s.so.1", "so:libm.so.6"},
- 	Provides:         []string{"cmd:buck2=20260102-r0"},
+ 	Provides:         []string{"cmd:buck2=20260102-r1"},
  	InstallIf:        nil,
- 	Size:             45813748,
+ 	Size:             45854298,
- 	InstalledSize:    143357515,
+ 	InstalledSize:    143403272,
  	ProviderPriority: 0,
- 	BuildTime:        s"2026-01-02 20:30:24 +0000 UTC",
+ 	BuildTime:        s"2026-01-13 06:47:10 +0000 UTC",
- 	BuildDate:        1767385824,
+ 	BuildDate:        1768286830,
  	RepoCommit: strings.Join({
- 		"f97450174ff20bb21fcddac7194ce62e3d9f6a9",
+ 		"13df0b36727e6d46f87a36183b76cb4601aff83",
  		"4",
  	}, ""),
  	Replaces: nil,
  	DataHash: "",
  }

➕ Added:

  • var/lib/db/sbom/buck2-20260102-r1.spdx.json (644)

➖ Removed:

  • var/lib/db/sbom/buck2-20260102-r0.spdx.json (644)

🔺 Changed:

.melange.yaml
- -rw-r--r-- 11823 2026-01-02 20:30:24 .melange.yaml
+ -rw-r--r-- 12028 2026-01-13 06:47:10 .melange.yaml
usr/bin/buck2
- -rwxr-xr-x 142303632 2026-01-02 20:30:24 buck2
-   APK-TOOLS.checksum.SHA1: "2ae99bbd1401498b6882229a257592f4c859ecdc"
+ -rwxr-xr-x 142347760 2026-01-13 06:47:10 buck2
+   APK-TOOLS.checksum.SHA1: "3c46e254c76225cdbae56255c8bd72a208b6f4e1"