openSUSE-SU-2026:21567-1: moderate: Security update for zk

openSUSE security update: security update for zk
-------------------------------------------------------------

Announcement ID: openSUSE-SU-2026:21567-1
Rating: moderate
References:

  * bsc#1253784



Cross-References:

  * CVE-2025-58181



CVSS scores:

  * CVE-2025-58181 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
  * CVE-2025-58181 ( SUSE ): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Affected Products:

         openSUSE Leap 16.0

-------------------------------------------------------------

An update that solves one vulnerability and has one bug fix can now be installed.

Description:

This update for zk fixes the following issues:

Changes in zk:

- Update to version 0.15.6:
  * Parse links to notes in frontmatter
  * Set filters for lsp completion items from the config
  * Set a note's modification time in frontmatter and allow for custom key
    naming for both creation and modification keys
  * Indexing made significantly more performant
  * Support filtering by date and time with "<date> <time>" instead of
    <date>T<time> only
  * Exclude globs now prune matching directories from indexing, improving
    speed of indexing

- Update to version 0.15.5:
  * List, edit and filter for broken links with --broken-links
  * Update strftime package, supporting %g and %G formats in the
    {{format-date}} helper
  * Option to append links to selected text, instead of replacing
  * Paths with ~ and env variables no longer error when passed to
    --notebook-dir and --working-dir
  * Guard LSP against unnecessary erroring on missing textDocument/definition
    capabilities

- Update to version 0.15.4:
  * fix "jump to definition" follows wrong link
  * zk config --list <object> (by @andrebauer, 484)
  * Ignore commented links for LSP diagnostics. Use an AST to parse files, fixing
  * other similar edge cases.
  * Links in markdown footnotes now included in :ZkLinks
  * Indexing notebook now 35% and 74% faster for full and incremental indexing
  * respectively
  * Stop crashing lsp server when server received textDocument/completion request with out of range parameters.
  * lsp: Provide completion after [[ on lines with multi-byte characters
  * Prevent crash in LookForward when the parameters is out of characters number.

- Update to version 0.15.2
  * Find notes with missing backlinks using zk list --missing-backlink
  * LSP diagnostic for missing backlinks when other notes link to current note
    without reciprocal links
  * Code action to add missing backlinks
  * LSP diagnostic for self-referential links
  * Release tarballs now output the program version
  * Config path can be set with $ZK_CONFIG_DIR
  * bump deps: golang.org/x/crypto v0.45.0 fixes CVE-2025-58181

- Update to version 0.15.0
  * fixed LSP crashes when editing code fences and/or working in text files
    with code fences
  * new feature to set a group path "by name", in that any directory with the
    same name can share the same group rules, no matter how deep in the
    notebook. See references below.

- Update to version 0.14.2
  * Path in .zk/config.toml for the default note template now accepts
    UNIX "~/paths"
  * Find notes without tags with zk list --tagless
  * fix: LSP ignores magnet links as links to notes
  * fix: Note titles with double quoted words no longer break json output
  * fix: Grammar in error output
  * fix: Group rules could not be nested


Patch instructions:

   To install this openSUSE security update use the suse recommended installation methods
   like YaST online_update or "zypper patch".
   Alternatively you can run the command listed for your product:

- openSUSE Leap 16.0

   zypper in -t patch openSUSE-Leap-16.0-packagehub-481=1

Package List:

- openSUSE Leap 16.0:

  zk-0.15.6-bp160.1.1

References:

  * https://www.suse.com/security/cve/CVE-2025-58181.html