Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[20.09] hedgedoc: 1.6.0 -> 1.7.1 (security) #107790

Merged
merged 4 commits into from Dec 28, 2020
Merged

[20.09] hedgedoc: 1.6.0 -> 1.7.1 (security) #107790

merged 4 commits into from Dec 28, 2020

Conversation

Ma27
Copy link
Member

@Ma27 Ma27 commented Dec 28, 2020

Motivation for this change

The update of hedgedoc (formerly known as codimd) should be backported to release-20.09 for the following reasons:

This includes changes from #107762, #105385. The change is backwards-compatible since the original data-path (/var/lib/codimd) is still used if stateVersion < 21.03.

cc

  • @WilliButz (author of the update)
  • @NixOS/backports
  • @petabyteboy who also worked on a codimd update quite recently and might be interested in this.

Note: 16b61e7 is additionally needed. @WilliButz and I are currently not sure why this is needed for the backport, but everything works fine on master.

Things done
  • Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS linux)
  • Built on platform(s)
    • NixOS
    • macOS
    • other Linux distributions
  • Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
  • Tested compilation of all pkgs that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review wip"
  • Tested execution of all binary files (usually in ./result/bin/)
  • Determined the impact on package closure size (by running nix path-info -S before and after)
  • Ensured that relevant documentation is up to date
  • Fits CONTRIBUTING.md.

WilliButz and others added 4 commits December 28, 2020 10:57
@WilliButz @Ma27
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc
c23d81c 
CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x.

https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
(cherry picked from commit e19995e)
@WilliButz @Ma27
nixos/codimd: rename to hedgedoc
9a7aae4 
CodiMD was renamed to HedgeDoc. The user, group and state directory,
will be named hedgedoc instead of codimd, starting with stateVersion
"21.03".

(cherry picked from commit 1c55621)
@WilliButz @Ma27
hedgedoc: 1.7.0 -> 1.7.1 (fixes CVE-2020-26286 and CVE-2020-26287)
53ed5fc 
https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.1
GHSA-wcr3-xhv7-8gxc
GHSA-g6w6-7xf9-m95p
(cherry picked from commit 484d851)
@Ma27
hedgedoc: fix NODE_PATH
16b61e7
@Ma27 Ma27 changed the title hedgedoc: 1.6.0 -> 1.7.1 (security) [20.09] hedgedoc: 1.6.0 -> 1.7.1 (security) Dec 28, 2020
@ofborg ofborg bot requested review from globin and WilliButz December 28, 2020 12:25
@WilliButz WilliButz merged commit b0b42fe into NixOS:release-20.09 Dec 28, 2020
@Ma27 Ma27 deleted the backport-hedgedoc branch December 28, 2020 13:26
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@WilliButz WilliButz WilliButz approved these changes

@globin globin Awaiting requested review from globin

Assignees
No one assigned
Labels
1.severity: security 6.topic: nixos 8.has: clean-up 8.has: documentation 8.has: module (update) 8.has: package (new) 10.rebuild-darwin: 0 10.rebuild-linux: 1-10 11.by: package-maintainer
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
2 participants
@Ma27 @WilliButz