openSUSE-SU-2026:21560-1

See a problem?
Import Source
https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:21560-1.json
JSON Data
https://api.osv.dev/v1/vulns/openSUSE-SU-2026:21560-1
Upstream
Related
Published
2026-08-10T16:06:46Z
Modified
2026-08-12T18:23:42Z
Summary
Security update for kak-lsp
Details

This update for kak-lsp fixes the following issues:

Changes in kak-lsp:

  • Update to version 21.0.2:

    • Fix a regression that broke compatibility with Kakoune versions older than 2026.05.21
    • Add a default configuration for Hare, using hare-lsp
    • Fix hangs after editing a file without a trailing newline, such as an empty file
    • Use nixd instead of nil as the default language server for nix
    • Fix buffer-sync corruption when .editorconfig sets insert_final_newline = false
  • Refresh the vendored registry. Recording the state of the open vendored-crate CVEs against it, none of which this package is affected by:

    • CVE-2026-25541 (boo#1274502): bytes is 1.12.1, above the 1.11.1 fix
    • CVE-2025-3416 (boo#1242654): the openssl crate is 0.10.81, above the 0.10.72 fix; it was already 0.10.80 before this update
    • CVE-2025-55159 (boo#1248048): slab is 0.4.12, above the 0.4.11 fix; only 0.4.10 was ever affected and this package never shipped it
  • Update to version 20.0.0:

    • v20.0.0
    • Update changelog
    • Fix tinymist documentation URL
    • Fix tinymist preview config key. previewFeature only works for the vscode plugin
    • Encode brackets for file paths
    • feat: swift/sourcekit-lsp support
    • Paal �ye-Str�mme Copyright Waiver
    • Make sure buffer synchronization works even when finaleol is missing
    • workspace/executeCommand: don't panic on invalid args JSON
    • servers.kak: update markdown-oxide root markers
    • Inline lsp-initial-goto-position
    • Fix function_casts_as_integer warning
    • lsp-capabilities: remove stale default mappings
    • changelog new erlang default server
    • fix(ci/commit-new-release.sh): interpolate version number
    • Change default language server for erlang
    • lsp-inlay-hint-apply-*: fix crash when no hints avail
    • Add inlay hint textedit support
    • start new cycle
  • Update to version 19.0.1:

    • v19.0.1
    • Don't print Hover: prefix if there are no diagnostics
    • Changelog for regression fix
    • Fix lsp-find-error incorrectly handling --previous flag
    • ci/commit-new-release.sh: support jj
    • start new cycle
  • Update to version 18.2.0:

    • v18.2.0
    • Update changelog
    • Remove misleading debug log in SessionRenamed hook
    • Make diagnostics buffer one-line-per diagnostics
    • test/gopls-dynamic-settings.sh: fix for recent gopls
    • clippy
    • controller: consume entire request before checking for user errors
    • Add support vuejs
    • Fix crash on invalid text edit ranges
    • Send initializationOptions and workspace/didChangeConfiguration as expected by jdtls
    • cargo update
    • Fix type inference errors with deranged 0.4.1
    • Fix symbol name prefix for breadcrumbs
    • Work around breaking change in deranged crate
    • Simplify recursive breadcrumbs calculation
    • Language-specific SymbolKind rendering
    • lsp-goto-document-symbol: remove symbol kind suffix
    • start new cycle
  • Update to version 18.1.3:

    • v18.1.3
    • Use the right language ID when [language.foo] is in effect
    • Remove unused line-specs option
    • Better variable name for code lens line-specs value
    • lsp-object: don't send documentSymbol to servers that don't support it
    • Include language server name in stderr logs
    • Use rust-analyzer from PATH
    • Work around lsp-rename didChange failing when using window scope
    • Send texlab-specific requests only to servers that support them
    • Fix dart language server command
    • Add kak-lsp server PID to the closing log message
    • Report more diagnostics information, in multiple lines
    • Fix regression causing spurious/missing server name in hover
    • Address clippy lints
    • Config knob to override magic single-instance setting
    • Back out "Add curly underline to DiagnosticError face"
    • start new cycle
  • Update to version 18.1.2:

    • Silence errors from non-default hooks
    • Fix languageId for JSX/TSX files
    • Silence deprecation warning
    • Add curly underline to DiagnosticError face
  • Update to version 18.1.1:

    • Make crash reporting optional for now
    • Touch up installation instructions in readme
    • Make force-exit code paths safer
    • Extract function
    • Rework "Prevent buffer content logic from reading to much"
    • Don't send debug log about excessive progress reports to editor
    • Make test/clangd-invalid-utf8.sh compatible with older clangd
    • Fix crash when legacy "language" config option uses language IDs
    • Set LAST_CLIENT earlier
    • test/clangd-invalid-utf8.sh: fix for modern clang
    • Add biome to CSS and GraphQL
    • On crash, disable LSP hooks in current buffer
    • Simplify sentry integration
    • Work around crash on unsaved files after server restart
    • Add context to crash report message
    • Include formatted panic info and backtrace in crash report
    • Crash reporting via sentry.io
    • Make the default panic message a little less intimidating
    • Generalize option change hook parsing code
    • Back out "Fix fake textDocument/didOpen for unsaved files"
    • Back out "Make sure to call textDocument/didOpen when lsp_servers is set after BufCreate"
    • Prevent buffer content logic from reading to much
    • Fix crash on during -sync command
    • Make sure to call textDocument/didOpen when lsp_servers is set after BufCreate
    • Add commented config for tailwindcss-language-server
    • Fix fake textDocument/didOpen for unsaved files
    • Stop logging the lsp-show-error call
    • Fix garbage languageId being sent on lsp-workspace-symbol
    • Clean up editor command dispatch code
    • Rename command sender type
    • Fix corruption applying text edits to non-buffer, non-ASCII files
    • Separate out function for applying text edits to in-memory data structure
    • Apply clippy lints
    • Update unit tests
    • Consolidate error reporting
    • Work around missing error on missing code lens after server restart
    • Type for client name
    • Rework editor-command sending
    • Remove most uses of EditorMeta::session
    • Remove vestiges of multi-session code
    • Bravely remove obsolete command_fifo, make response_fifo handling more robust
    • Fix flaky test/gopls-goto-definition.sh
    • Remove unused function
    • Add more details to fifo log
    • Remove unused parameter
    • Use a separate field for requests pending initialization resp. textDocument/didChange
    • Fix hang when sync request is used in hook when LSP is disabled
    • Fix lsp-did-change not being sent for lsp-code-actions-sync
    • Fix lingering sync state when lsp is disabled
    • Remove unused lsp-with-option command
    • Stop printing panic backtrace twice
    • Add badges for latest release and chat networks
    • Fix stacktrace being printed on EPIPE, remove redundant error output
    • Call out feedback/support channels a bit more
    • Stop linking to the Wiki page for installing servers
    • Only set javascriptreact/typescriptreact language ID for jsx/tsx files
  • Update to version 18.1.0:

    • Fix mixed-up order in tailwindcss example
    • Fix bell in modeline not being cleared on ShowMessage notifications
    • Fix patttern typo
    • Add markdown-oxide language-server
    • Add ruby-lsp language-server
    • Fix stale quoting in lsp-do-send-sync
    • Add log statements for raw request, handle EWOULDBLOCK/EAGAIN
    • Use write instead of %val{selection} to send buffer contents
    • Use a nonblocking fifo instead of pykak-style alternating fifos
    • Address clippy lint
    • Extend macOS workarounds to buffer synchronization
    • Fail early again on missing language.foo.command field
    • Also use elixir-ls on eex files
    • Fail startup if session state files already exists
    • Don't create session state if session is already running
    • Escalate failure if kak-lsp daemon fails to start
    • Don't clean up parent of session directories
    • Do not briefly start kak-lsp on KakEnd if lsp-enable has never been called
    • Fix typo in lsp-exit
    • Rectify inconsistent quoting in recommended mappings
    • Don't block when language servers are slow to exit
    • Work around hang due to lost fifo on macOS
    • Restyle --help output
    • Fix test/clangd-diagnostic-gutter.sh flakiness
    • Fix test/run not finding python on macOS
    • Remove bad text edit assertion
    • Braces in commented out code must match too
    • The correct validation setting for CSS is css.validate = true
    • Add CSS, HTML and JSON options, add Haskell's static-ls
    • Workaround macOS waitid() not zeroing si_signo
    • Fix waitid() being called unnecessarily
    • Fix formatting spuriously moving cursor with vscode-html-language-server
    • Fix Rust version
    • Workaround HTML/CSS language servers not enabling formatting
    • Workaround HTML/CSS language server crashing due to missing validProperties
    • Fix crash interpreting text edit without trailing newline
    • Clean up a debug log
    • Remove dependency on Rust 1.80
    • Fix regression causing crash when language server command fails exec()
    • Don't send SIGTERM to language server, remove obsolete wait()
    • Simplify sending of initialization options
    • Fix regression causing hangs on restart
    • Fix regression causing server configuration to be sent as initialization option
    • Fix regression causing "kak -p" to become a zombie
    • Remove "set-option -add" from most commented default configs
    • Back out "lsp-start to wait until existing server has exited"
    • Fix race conditions reading kak-lsp PID file
    • Send SIGTERM, not SIGKILL to shut down inert language server
    • Speed up language server shutdown
    • lsp-exit to wait until the session directory is removed
    • Remove shell calls from async request sending
    • Drain fifo on exit to unblock Kakoune
    • Remove unnecssary environment variable
    • Refactor temporary directory cleanup logic
    • lsp-start to wait until existing server has exited
    • Wait for PID file creation after start
    • Move fifo into a per-session directory
    • Remove errant semicolon
    • Remove shell calls for code-actions and highlight-references hooks
    • Move hook definition out of the way
    • Stop using temporary file also for textDocument/didChange and textDocument/didOpen
    • typst: add default configuration
    • Mohamad Makki Copyright Waiver
    • Update manual installation instructions for ARM macOS
  • Update to version 18.0.3:

    • Update changelog for release
    • Disable CI runs for a special "docs" branch
    • Scala Metals: turn off Unicode icons until Kakoune can handle emoji width
    • Simply use stdout instead of fd 3 for request sending
    • Remove redundant fifo re-creation
    • Elide temporary file when writing to fifo
    • Fix escaping if session name starts with a dash
    • Move loop-invariant set-option out of the loop
    • Fix window/showMessageRequest ID deserialization
    • lsp-disable: unset LSP modeline
    • Fix eslint workaround
    • Fix crash when "language" key is used in legacy kak-lsp.toml
    • julia lsp configuration: move root_globs
    • minor: fix typo in julia lsp config
    • cargo update
    • cargo clippy
    • Fix crash in lsp-selection-range
    • Show error instead of crashing if lsp_servers root is not an absolute path
    • Block LSP requests after KakEnd to work around delay on bad config
    • lsp-do-send: also block SIGINT once we have acquired the fifo
    • README: update "Pre-built binaries" section
    • Fix state transition when lsp-enable{,-window} are accidentally mixed
    • Remove shell call from lsp-if-no-servers
    • Remove misleading "set-option -add lsp_server" from default hooks
    • lsp-object: fix crash on invalid param, improve docs
  • Update to version 18.0.2:

    • v18.0.2
    • README: link to troubleshooting section
    • Fix stale comment in test
    • Update changelog
    • Show panics in an info box
    • Generate a core dump when crashing via a Rust panic
    • lsp-definition: explain fallback in error message
    • Fix crash in lsp-highlight-references
    • Log kak-lsp daemon PID on startup
    • Removed redundant error check
References

Affected packages

openSUSE:Leap 16.0 / kak-lsp

Package

Name
kak-lsp
Purl
pkg:rpm/opensuse/kak-lsp&distro=openSUSE%20Leap%2016.0

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
21.0.2-bp160.1.1

Ecosystem specific

{
    "binaries": [
        {
            "kak-lsp": "21.0.2-bp160.1.1"
        }
    ]
}

Database specific

source
"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:21560-1.json"