openSUSE-SU-2026:21277-1

This update for go-sendxmpp fixes the following issues:

Changes in go-sendxmpp:

• Update to 0.16.0: Added:

  • Add Ox support to http-upload.
  • Add Ox support for private group chats.
  • Show error cause if joining MUCs failedi (requires go-xmpp >= v0.3.5). Changed:
  • Fix --ox-delete-nodes.
  • Fix receiving of 1-1 messages while joined in a MUC.
  • Use go-sendxmpp + a random ID as fallback MUC alias.
  • Strip leading "xmpp:" from recipients.
  • Strip trailing "?join" from MUC JIDs.
  • Add context for timeouts in stanza handling.
  • Check ID for disco items reply (requires go-xmpp >= v0.3.6).
  • Reduce channel buffer size to 1 where only one item will be returned.
  • Deprecate legacy PGP.
  • CVE-2026-1229: The CombinedMult function produces an incorrect value (bsc#1265538) Bump circl to 1.6.3
  • CVE-2026-39821: Failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266617) Bump net to 0.56.0

• Update to 0.15.8:

  • Fix windows build (windows doesn't support syscalls Setgid and Setuid).

• Update to 0.15.7:

  • Fix http-upload with legacy PGP encryption.
  • Fix reading of environment variables.
  • Fix a bug in looking up host meta 2.
  • Try to drop root privileges before connecting to the server.
  • Fix crash if a config key has no value.
  • Use a salt for stored FAST token.
  • Increase scrypt iterations for storing FAST token from 32768 to 65536.
  • Log a warning when --no-tls-verify or -n is set.

• Update to 0.15.6: Added:

  • New config option allow_plain. Changed:
  • Explain each configuration option in manpage go-sendxmpp(5).
  • Improve config parsing robustness.
  • Update link in manpage as Gitlab calls issues now work items.
  • Recognize stanza size limit updates after authentication (via go-xmpp >= v0.3.3).
  • Tell connection target in error message when failing to connect.

• Drop tar-scm service and use regular tarball and go_modules

• Update to 0.15.5:

  • Fix SASL SCRAM Downgrade Protection in case of server providing different mechanisms for SASL and SASL2 (requires go-xmpp >0 v0.3.2).

• Update to 0.15.4:

  • http-upload: Manually set content length for HTTP request (fixes issues with certain http modules/proxies).

• Update to 0.15.3:

  • Fix PLAIN authentication for SASL2 (requires go-xmpp >= v0.3.1).

• Update to 0.15.2:

  • Use UUIDv7 instead of UUIDv4 for stanza IDs (requires go-xmpp >= v0.2.19).
  • Fix stanza syntax error for legacy PGP messages.
  • Print error if legacy PGP and Ox are requested simultaneously.
  • Reworked OOB file sending and http-upload to use new functions from go-xmpp library (requires go-xmpp >= v0.3.0).
  • Try password login if FAST login fails.