Re: branch master updated: gnu: python-lxml: Update to 4.6.5.

Re: branch master updated: gnu: python-lxml: Update to 4.6.5.

[Mathieu Othacehe]

Hey

>     * gnu/packages/xml.scm (python-lxml): Update to 4.6.5.

I had to revert it as it caused >15k rebuilds. I also cancelled all the
triggered builds in the CI.

Thanks,

Mathieu

Re: branch master updated: gnu: python-lxml: Update to 4.6.5.

[Danny Milosavljevic]

[-- Attachment #1: Type: text/plain, Size: 481 bytes --]

Hi Mathieu,

On Mon, 15 Aug 2022 16:24:03 +0200
Mathieu Othacehe <othacehe@gnu.org> wrote:

> >     * gnu/packages/xml.scm (python-lxml): Update to 4.6.5.  
> 
> I had to revert it as it caused >15k rebuilds. I also cancelled all the
> triggered builds in the CI.

Thanks for doing it!

But guix refresh -l python-lxml reported one package O_o

Now I see that python-lxml-4.7 shadows it.

Note: This would have fixed two CVEs, CVE-2021-43818 and CVE-2021-43818.


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: branch master updated: gnu: python-lxml: Update to 4.6.5.

[Marius Bakke]

[-- Attachment #1: Type: text/plain, Size: 634 bytes --]

Danny Milosavljevic <dannym@scratchpost.org> skriver:

> Hi Mathieu,
>
> On Mon, 15 Aug 2022 16:24:03 +0200
> Mathieu Othacehe <othacehe@gnu.org> wrote:
>
>> >     * gnu/packages/xml.scm (python-lxml): Update to 4.6.5.  
>> 
>> I had to revert it as it caused >15k rebuilds. I also cancelled all the
>> triggered builds in the CI.
>
> Thanks for doing it!
>
> But guix refresh -l python-lxml reported one package O_o
>
> Now I see that python-lxml-4.7 shadows it.
>
> Note: This would have fixed two CVEs, CVE-2021-43818 and CVE-2021-43818.

Can you add a "graft" for this version instead of updating in-place?


[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 247 bytes --]

Re: branch master updated: gnu: python-lxml: Update to 4.6.5.

[zimoun]

Hi,

On mar., 16 août 2022 at 09:51, Marius Bakke <marius@gnu.org> wrote:

>>> >     * gnu/packages/xml.scm (python-lxml): Update to 4.6.5.  

>> Now I see that python-lxml-4.7 shadows it.
>>
>> Note: This would have fixed two CVEs, CVE-2021-43818 and CVE-2021-43818.
>
> Can you add a "graft" for this version instead of updating in-place?

Graft 4.6.3 by the already packaged 4.7?  Or graft 4.6.3 by 4.6.5
because one of the 5208 dependant packages is incompatible with 4.7?


Cheers,
simon

Re: branch master updated: gnu: python-lxml: Update to 4.6.5.

[Ludovic Courtès]

Hi Danny!

While you’re here :-), could you reply to that request of mine
concerning blog post licensing?  TIA!  :-)

  https://lists.gnu.org/archive/html/guix-devel/2022-07/msg00059.html

Ludo’.