openSUSE-SU-2026:22140-1

This update for aliyun-cli fixes the following issue:

• CVE-2026-63209: github.com/klauspost/compress: signed integer overflow in s2.NewDict() allows an attacker to bypass repeat index validation and cause a process crash (bsc#1283596).

Changes for aliyun-cli:

• Update to version 3.5.1

• Add opt-in built-in OSS JSON/JSONL listings with bounded pages and resumable cursors, structured errors with recovery guidance, and non-interactive confirmation handling (#1452).
• Add offline validation and read-only plans for single-file uploads and single-object deletion; record exact failed targets in exclusive JSONL manifests for cp/sync and expose sync deletion-phase state (#1452).
• Fix the OSS bridge to preserve option order and --, propagate parser and service errors, pass profile region/timeouts/retry budgets, and refresh host credentials at request time without injecting them into argv (#1454).
• Stop replaying writes after ambiguous transport or server failures; classify retries with jittered backoff, join workers before closing reports, and fix progress data races and failure-report filename collisions (#1452).
• Enforce the host safety policy for legacy OSS operations and reject unsupported preview combinations (#1452, #1454).
• Harden policy parsing and environment overrides to fail closed on invalid configuration; explicit deny rules cannot be bypassed by --force, --yes, or AI mode.
• Enforce the safety policy before built-in extension dispatch (cliext/safety.go).
• Restrict legacy FNF request-signing compatibility to a product allowlist (#1447).
• API alias canonicalization was reverted and held: aliases and PascalCase/ kebab-case spellings remain separate policy matches, matching command spelling exactly as typed.
• Version AI-mode OpenAPI and OSS error envelopes with schemaVersion: "v1", and return structured startup configuration errors (#1453).
• Add ALIBABA_CLOUD_CLI_AGENT_INTEGRATION controls for automatic AI mode; expand agent detection, User-Agent attribution, and Qoder China CLI detection (#1445, #1455).
• Support case-insensitive product routing for in-process OpenAPI commands (#1445).
• Expose regional and VPC product endpoints through queryable product Help (#1448).
• Support camel RPC flat arrays (#1456) and prefer product prefix/substring suggestions over edit distance in "Did you mean" output.
• Upgrade JMESPath to support json.Number, preserving large-number comparison and sorting precision and fixing empty-array average semantics.
• Dispatch newly installed metadata plugins in-process (#1439).
• Harden plugin archive extraction, package replacement/rollback, and download URL diagnostics (#1442).
• Redact JSON and form bodies based on content while preserving the encoding of original form stars; keep raw and unparseable dry-run bodies intact (#1440, #1449).
• Prefer native macOS architecture packages in install.sh (#1433).
• Keep prerelease tags off the stable latest pointer and fail closed when release asset downloads are incomplete (#1437).
• Include cliext in required checks, fix cross-platform test failures (#1446), restore single-file entrypoint builds, and stabilize language tests.
• Update the aliyun-openapi-meta submodule and release jobs.
• Add the OSS automation guide (en / zh-CN), document startup errors, exit statuses and command-spelling safety matching (#1450), and add the v3.5.1 CHANGELOG entry.

• from version 3.5.0

• docs: add StsToken credential mode to README by @yndu13 in (#1403)
• Built-in plugin and AI MODE enhancement by @yndu13 in (#1411)
• Update Aliyun OpenAPI meta data

• Update to version 3.4.11

• feat(openapi): extend --estimate-cost coverage (pricing context, SLS/openapi path, oss bridge, by-triple) and scripting contract by @api-tool-agent in (#1399)

• from version 3.4.10 (no changes)
• from version 3.4.9

• fix(maxc): fall back when symlink creation fails on Windows by @yndu13 in (#1390)
• fix: quote-aware External process_command parsing by @yndu13 in (#1391)
• fix: POSIX line-continuation in External process_command splitting by @yndu13 in (#1392)
• Improve invalid flag error with did-you-mean hints by @yndu13 in (#1394)
• fix: atomically write config.json via temp+rename by @yndu13 in (#1387)
• fix: detect throttling by x-acs-retry-after header by @yndu13 in (#1395)
• feat: add aliyun ecctl for Elastic Compute Control CLI by @yndu13 in (#1397)
• fix: allow --profile with aliyun oss subcommands by @yndu13 in (#1398)

• Update to version 3.4.8

• fix(test): mock plugin index for offline-stable Windows CI by @yndu13 in (#1379)
• fix: correct waiter timeout/interval range validation by @yndu13 in (#1382)
• feat(openapi): add --cli-dry-run flag for built-in PascalCase commands by @CodeSpaceiiii in (#1383)
• fix: persist configure read-timeout as read_timeout by @yndu13 in (#1384)
• fix: ignore empty --mode so env credentials still apply by @yndu13 in (#1386)
• feat: add mseutil command to aliyun CLI by @yndu13 in (#1381)
• fix(oss): honor profile endpoint and endpoint-type vpc by @yndu13 in (#1385)
• fix: correct import order in openapi/library_test.go by @CodeSpaceiiii with @Copilot in (#1388)
• Fix invisible API parameter names in help output (bold-black on dark terminals) by @mvanhorn in (#1362)
• feat: integrate flow-cli into Aliyun CLI by @yndu13 in (#1380)
• fix(esacli): harden exec override and shorthand flags by @yndu13 in (#1389)

• from version 3.4.7

• {plugin} Add alias support for plugin by @AllyW in (#1376)
• feat(mock): add response_body_size for controllable mock stdout size by @yndu13 in (#1378)
• fix(plugin): prevent bulk update plugin pointer aliasing by @yndu13 in (#1377)

• from version 3.4.6

• feat(openapi): add --estimate-cost-context to pass PricingContext to quotes by @LCLSpring in (#1373)
• feat(mock): add delay_ms field to simulate command execution latency by @yndu13 in (#1375)

• Update to version 3.4.5

• [Feature] Support ESA CLI Sub Command by @msyysm1211 in (#1345)
• feat(config): support STS endpoint override for OIDC and role auth by @yndu13 in (#1372)

• from version 3.4.4

• (no changes)

• from version 3.4.3

• fix: correct valid typo in invalid command error by @yndu13 in (#1365)
• {Misc} Add ALIBABA_CLOUD_DISABLE_EXTERNAL_PROCESS to disable external process by @AllyW in (#1366)

• from version 3.4.2

• feat(openapi): add --estimate-cost and list-supported-pricing-apis by @LCLSpring in (#1364)

• Update to version 3.4.1

• [Feature]Add Aliyun Lindorm CLI Subcommand by @MistySoul in (#1361)
• {cliext} Add aliyun spark-submit by @AllyW in (#1358)

• from version 3.4.0

• feat(acrutil): extract shared binary manager and add diagnosis subcommand by @copyrightpoiiiii in (#1349)
• [feature] add rostran sub command by @xiao201208 in (#1350)
• {OpenAPI} Add --cli-dry-run-json by @AllyW in (#1306)
• {Misc} Fix plugin three layer cmd help by @AllyW in (#1343)
• Feature/support anonymous by @yuexiu94 in (#1354)
• feat: support retry-after policy for throttling error by @yndu13 in (#1355)

• Update to version 3.3.23

• {Plugin} Allow plugins to opt out of host profile enforcement by @AllyW in (#1348)

• Update to version 3.3.22

• {Logging} Skip list for self-built-gateway products by @AllyW in (#1346)

• from version 3.3.21

• {Configure} Match policy rules against the command users actually type for ROA by @AllyW in (#1344)

• from version 3.3.20

• {OpenAPI} Add call context logging by @AllyW in (#1342)

• from version 3.3.19

• [Feature] Support MaxC CLI Sub Command by @dingxin-tech in (#1332)
• feat(appmanager): Generalized PrepareEnv credential pass-through supports multiple authentication modes by @mengjunwei-mjw in (#1341)

• from version 3.3.18

• Improve CMS2 command descriptions and clarify exception return codes by @tingbin-ctb in (#1337)
• feat(iact3): add iact3 subcommand with manual upgrade by @xiao201208 in (#1336)
• Add kmscli command by @oobujieshi in (#1340)

• from version 3.3.17

• {Plugin} Support lang and profile from flag for plugin execution by @AllyW in (#1330)
• Computenest pypi venv by @mengjunwei-mjw in (#1331)
• feat: add codeup-cli subcommand for migrating third-party code repos by @imu2008 in (#1335)

• from version 3.3.16

• Optimize error messages by @CodeSpaceiiii in (#1327)
• {Openapi} Return InvalidApiError for unknown API on restful products by @AllyW in (#1326)
• feat(acrutil): Add Alibaba Cloud Container Registry(ACR) Skill management CLI subcommand by @copyrightpoiiiii in (#1329)
• {Configure} Support BearerToken profile mode by @AllyW in (#1333)

• from version 3.3.15

• feat add saectl by @Beimingx in (#1319)
• Cloud Monitor version 2.0: Independent binary access, Aliyun CMS2 subcommands by @thinkbetter18 in (#1322)
• feat(otel): integrate OpenTelemetry support with environment variable by @CodeSpaceiiii in (#1324)
• aliyuncms has been renamed to aliyuncms2. COMPAT_MODE, USER_AGENT, AI_USER_AGENT, and OTEL headers have been added. Issues with business parameter passing have been fixed by @tingbin-ctb in (#1325)

• Update to version 3.3.14

• feat(appmanager): add appmanager subcommand with PyPI+OSS dual-source by @mengjunwei-mjw in (#1317)
• {Misc} Add --name and update version check message for plugin install and adjust agent detection by @AllyW in (#1316)

• from version 3.3.13
• Update to version 3.3.12

• Add AgentBay CLI command and implement language setting logic by @CodeSpaceiiii in (#1311)
• {Profile} Add external-account-type for user profile by @AllyW in (#1312)
• Implement CLI mock command with add, import, remove, list, clear, and path subcommands by @CodeSpaceiiii in (#1313)
• {Openapi} Add agent segment to user-agent by @AllyW in (#1314)

• from version 3.3.11

• Fix retrySaveProfile function to return success status and update tests by @CodeSpaceiiii in (#1310)

• Update to version 3.3.10
• from version 3.3.9

• {Config} Add safety policy env parsing by @AllyW in (#1307)

• from version 3.3.8

• {Core} Add plugin install --package and plugin show by @AllyW in (#1301)

• from version 3.3.7

• {config} Fix: Only honor ALIBABA_CLOUD_ENDPOINT for profile endpoint env injection by @AllyW in (#1304)

• from version 3.3.6

• {Core} Fix endpoint shorthand flag -e of oss by @AllyW in (#1303)

• from version 3.3.5

• feat: profile support endpoint flag by @crimson-gao in (#1298)
• {Core} Add aliyun upgrade and configurable plugin index source and fix CloudSSO/OAuth one-off CLI flags persisting by @AllyW in (#1299)

• Update to version 3.3.4

• {Core} Fix unknown-flag parsing for plugin-style subcommands by @AllyW in (#1296)

• from version 3.3.3

• {Core} Add ai-mode and safety policy configuration by @AllyW in (#1295)