Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

hedgedoc: 1.7.0 -> 1.7.1 (fixes CVE-2020-26286 and CVE-2020-26287) #107762

Merged
merged 1 commit into from Dec 27, 2020
Merged

hedgedoc: 1.7.0 -> 1.7.1 (fixes CVE-2020-26286 and CVE-2020-26287) #107762

merged 1 commit into from Dec 27, 2020

Conversation

WilliButz
Copy link
Member

@WilliButz WilliButz commented Dec 27, 2020 •
edited

Motivation for this change

https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.1
GHSA-wcr3-xhv7-8gxc
GHSA-g6w6-7xf9-m95p

I think that this should be ported to stable together with the recent rename to hedgedoc and the corresponding changes from #105385. Even though the name and logo changed, the functionality did not, so I don't see any real issue with porting this to 20.09.
I am not sure whether the release notes should just be removed or kept.
(ping @NixOS/nixos-release-managers for opinions)

Things done
  • Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS linux)
  • Built on platform(s)
    • NixOS
    • macOS
    • other Linux distributions
  • Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
  • Tested compilation of all pkgs that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review wip"
  • Tested execution of all binary files (usually in ./result/bin/)
  • Determined the impact on package closure size (by running nix path-info -S before and after)
  • Ensured that relevant documentation is up to date
  • Fits CONTRIBUTING.md.
  • Successfully deployed to an existing HedgeDoc instance

@WilliButz WilliButz added 1.severity: security 9.needs: port to stable A PR needs a backport to the stable release. labels Dec 27, 2020
@ofborg ofborg bot requested review from globin and Ma27 December 27, 2020 22:06
@Ma27
Copy link
Member

Ma27 commented Dec 27, 2020

I'm in favor of a backport:

  • there's an actual migration path for the rename implemented by @WilliButz. It will be needed earlier than anticipated, but it still means that no actual action is needed (AFAIU).
  • I'd actually consider it dangerous to attempt a backport of relevant patches in such a complex JS-based codebase.

@Ma27 Ma27 merged commit c4f4f74 into NixOS:master Dec 27, 2020
@Ma27
Copy link
Member

Ma27 commented Dec 27, 2020

Thanks!

Would wait with the backport until tomorrow in case we get feedback from either @NixOS/nixos-release-managers or @NixOS/backports .

@Ma27 Ma27 mentioned this pull request Dec 28, 2020
Merged
10 tasks
@WilliButz WilliButz added 8.has: port to stable A PR already has a backport to the stable release. and removed 9.needs: port to stable A PR needs a backport to the stable release. labels Dec 28, 2020
@WilliButz WilliButz deleted the update/hedgedoc/1.7.1 branch December 28, 2020 12:42
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@Ma27 Ma27 Ma27 approved these changes

@globin globin Awaiting requested review from globin

Assignees
No one assigned
Labels
1.severity: security 8.has: documentation 8.has: port to stable A PR already has a backport to the stable release. 10.rebuild-darwin: 0 10.rebuild-linux: 1-10 10.rebuild-linux: 1 11.by: package-maintainer
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
2 participants
@WilliButz @Ma27