-
-
Notifications
You must be signed in to change notification settings - Fork 2.2k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Updated xz to 5.6.2 #7916
Updated xz to 5.6.2 #7916
Conversation
I'm assuming you are aware of CVE-2024-3094 and didn't upgrade to 5.6.1 for that reason. Perhaps it is an overreaction at this point, but I'm wondering if we should consider completely removing liblzma from the wheels for the upcoming release. liblzma is only an indirect optional dependency via libtiff and users could just install from source if they need it. |
Yes, we're aware. I'd like to hold off on merging this until more clarity comes out of this from the experts. Xz is deeply in use in debian (e.g. dpkg) so they're digging pretty heavily now (https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1068024). |
xz 5.6.2 has now been released - https://github.com/tukaani-project/xz/releases/tag/v5.6.2 https://tukaani.org/xz-backdoor/
|
Should we also switch to using the GitHub release instead of SourceForge? Pillow/winbuild/build_prepare.py Line 179 in 114e017
Multibuild uses
|
Ok, GitHub does look to be the primary repository. I've pushed a commit. |
My thinking on this: I don't see anything particularly urgent/important in the changelog to merge this right now, so maybe we hold off for another release or so? |
Another release or so of ours, or of xz? I'm guessing you mean xz, as a way of increasing confidence that they have reviewed their code thoroughly. |
Of ours, but that could also include of xz :) Yeah, I don't think we're in a rush to upgrade, and it gives some more time for the dust to settle. |
More time has passed and things have settled. Any objections to merging this for our release next month? |
No objections. |
https://github.com/tukaani-project/xz/releases/tag/v5.6.2