Backport USN-3235-1 to 1.6.8.x stream #1640
Conversation
Using the pkg-config gem as a runtime dependency of nokogiri results in a license conflict. pkg-config is LGPL but nokogiri is MIT. Making the pkg-config gem optional solves this issue. Fixes sparklemotion#1488 and sparklemotion#1496 .
which is being made optional
which address CVE-2016-4658 and CVE-2016-5131. see sparklemotion#1615 for more information
Backports part of 10d49bb to v1.6.8.x branch. [ci skip]
|
Hi! Thanks for submitting this! I really would like to have a conversation about it before taking action. The 1.6.8.x release isn't supported anymore, and we're encouraging teams to upgrade to get security patches. Can you help me understand why upgrading to 1.7.x isn't an appropriate solution for you, if you need to patch this USN? Or alternatively, to use your system libraries to get a patched version of libxml2/libxslt? |
|
👋 Apologies for the delayed response.
🙇
I have some applications running in environments which have older (< v2.1) versions of Ruby. The intent of this change proposal was to apply this significant security patch to the most recent version of the 1.6.8.x branch in order to get this fix into production, while allowing the runtime environment to be upgraded to a modern generally available version of Ruby. |
Redmine users claims dropping old Ruby support. |
|
You'll note that Nokogiri 1.8.0 has been released, and we're still keeping the 1.7.x branch up to date with security patches. Your options are:
|
The f2dd079, 3b9ee4b and 002e4d8 commits shouldn't appear, but do because this was created from the
v1.6.8.1tag. Ideally I'd like to target a branch off thev1.6.8.1tag (e.g.v1.6.8.x). I'll happily clean up this changeset and retarget the base branch once that exists.💁 These changes backport the patches for USN-3235-1 back to the 1.6.8.x series.