mirror of
https://github.com/NixOS/nixpkgs.git
synced 2025-11-10 09:43:30 +01:00
See https://github.com/NixOS/nixpkgs/pull/312251#issuecomment-3416076466 I think it's frankly careless to merge something into nixpkgs that's two patch-releases behind the current patch-level of the _legacy branch_ of a software. Especially for security-sensitive things. On top, this got never updated even though there are two high-rated CVEs in this, i.e. CVE-2025-27773[1] and CVE-2024-52596[2]. [1] https://github.com/advisories/GHSA-46r4-f8gj-xg56 [2] https://github.com/advisories/GHSA-2x65-fpch-2fcm |
||
|---|---|---|
| .. | ||
| manual | ||