On Sat, 15 Jun 2024 05:52:14 +0200, Bjorn Ketelaars <bket@openbsd.org>
wrote:

> Diff below brings sysutils/rclone to 1.67.0, which fixes
> CVE-2023-45288 and CVE-2024-35255.
> - https://www.cve.org/CVERecord?id=CVE-2023-45288
> - https://www.cve.org/CVERecord?id=CVE-2024-35255
> 
> Full changelog can be found at
> https://rclone.org/changelog/#v1-67-0-2024-06-14.
> 
> Run tested on amd64 -current.
> 
> Backporting this diff to -stable is straightforward.
> 
> OK for committing this to -current

ok danj@

> and -stable?
> 
> 
> diff --git Makefile Makefile
> index 916b3afb845..ef389fd97b8 100644
> --- Makefile
> +++ Makefile
> @@ -1,6 +1,6 @@
>  COMMENT =	rsync for cloud storage
>  
> -V =		1.66.0
> +V =		1.67.0
>  DISTNAME =	rclone-v${V}
>  PKGNAME =	rclone-${V}
>  
> diff --git distinfo distinfo
> index 12d57cb8251..45e69c044b4 100644
> --- distinfo
> +++ distinfo
> @@ -1,4 +1,4 @@
> -SHA256 (rclone-v1.66.0-vendor.tar.gz) =
> FHF1proaSOZRbqLXJQsTfULZWdK0XR8IrpURoyWdi28= -SHA256
> (rclone-v1.66.0.tar.gz) =
> bWI/D6w3C1QVI5neF6r0mDWicD2w9ZpA5BHjoVWaBl0= -SIZE
> (rclone-v1.66.0-vendor.tar.gz) = 13547678 -SIZE
> (rclone-v1.66.0.tar.gz) = 17019917 +SHA256
> (rclone-v1.67.0-vendor.tar.gz) =
> gmRj2aK8XlEeCRwkvn1L9vLfOWcCZi+1KEmCI8yzm5Q= +SHA256
> (rclone-v1.67.0.tar.gz) =
> 84Y+8/y8wKoMoAxr8cCZvpRw3zYHUZEttckCHT5UnRA= +SIZE
> (rclone-v1.67.0-vendor.tar.gz) = 13795247 +SIZE
> (rclone-v1.67.0.tar.gz) = 17179909
>