openSUSE-SU-2026:21277-1

Description of the patch:

This update for go-sendxmpp fixes the following issues:

Changes in go-sendxmpp:

• Update to 0.16.0: Added:

  • Add Ox support to http-upload.
  • Add Ox support for private group chats.
  • Show error cause if joining MUCs failedi (requires go-xmpp >= v0.3.5). Changed:
  • Fix --ox-delete-nodes.
  • Fix receiving of 1-1 messages while joined in a MUC.
  • Use go-sendxmpp + a random ID as fallback MUC alias.
  • Strip leading "xmpp:" from recipients.
  • Strip trailing "?join" from MUC JIDs.
  • Add context for timeouts in stanza handling.
  • Check ID for disco items reply (requires go-xmpp >= v0.3.6).
  • Reduce channel buffer size to 1 where only one item will be returned.
  • Deprecate legacy PGP.
  • CVE-2026-1229: The CombinedMult function produces an incorrect value (bsc#1265538) Bump circl to 1.6.3
  • CVE-2026-39821: Failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266617) Bump net to 0.56.0

• Update to 0.15.8:

  • Fix windows build (windows doesn't support syscalls Setgid and Setuid).

• Update to 0.15.7:

  • Fix http-upload with legacy PGP encryption.
  • Fix reading of environment variables.
  • Fix a bug in looking up host meta 2.
  • Try to drop root privileges before connecting to the server.
  • Fix crash if a config key has no value.
  • Use a salt for stored FAST token.
  • Increase scrypt iterations for storing FAST token from 32768 to 65536.
  • Log a warning when --no-tls-verify or -n is set.

• Update to 0.15.6: Added:

  • New config option allow_plain. Changed:
  • Explain each configuration option in manpage go-sendxmpp(5).
  • Improve config parsing robustness.
  • Update link in manpage as Gitlab calls issues now work items.
  • Recognize stanza size limit updates after authentication (via go-xmpp >= v0.3.3).
  • Tell connection target in error message when failing to connect.

• Drop tar-scm service and use regular tarball and...