Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

zammad: 6.4.0 -> 6.4.1 #372724

Merged
merged 1 commit into from
Jan 10, 2025
Merged

zammad: 6.4.0 -> 6.4.1 #372724

merged 1 commit into from
Jan 10, 2025

Conversation

NetaliDev
Copy link
Member

https://zammad.com/en/releases/6-4-1

Includes security fix for ZAA-2024-05

Things done

  • Built on platform(s)
    • x86_64-linux
    • aarch64-linux
    • x86_64-darwin
    • aarch64-darwin
  • For non-Linux: Is sandboxing enabled in nix.conf? (See Nix manual)
    • sandbox = relaxed
    • sandbox = true
  • Tested, as applicable:
  • Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
  • Tested basic functionality of all binary files (usually in ./result/bin/)
  • 25.05 Release Notes (or backporting 24.11 and 25.05 Release notes)
    • (Package updates) Added a release notes entry if the change is major or breaking
    • (Module updates) Added a release notes entry if the change is significant
    • (Module addition) Added a release notes entry if adding a new NixOS module
  • Fits CONTRIBUTING.md.

Add a 👍 reaction to pull requests you find important.

@NetaliDev NetaliDev added the 1.severity: security Issues which raise a security issue, or PRs that fix one label Jan 10, 2025
@github-actions github-actions bot added 10.rebuild-darwin: 0 This PR does not cause any packages to rebuild on Darwin 10.rebuild-linux: 1-10 labels Jan 10, 2025
@nix-owners nix-owners bot requested a review from Radvendii January 10, 2025 18:54
LeSuisse
LeSuisse approved these changes Jan 10, 2025
View reviewed changes
Copy link
Contributor

@LeSuisse LeSuisse left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Builds and tests succeeds on Linux x86_64.

Can we backport zammad/zammad@880049b that seems to be the fix on stable?

@LeSuisse LeSuisse added the 9.needs: port to stable A PR needs a backport to the stable release. label Jan 10, 2025
@LeSuisse LeSuisse merged commit 1abe9f7 into NixOS:master Jan 10, 2025
24 checks passed
@NetaliDev
Copy link
Member Author

@LeSuisse as described in ZAA-2024-05 the vulnerability only affects version 6.4.X, so the version 6.3.1 on stable is not affected.

@NetaliDev NetaliDev removed the 9.needs: port to stable A PR needs a backport to the stable release. label Jan 12, 2025
@LeSuisse
Copy link
Contributor

Are you sure about that? Looking at their past advisories they seem to always only mention the officially supported branch?

The cherry-picked patch on 6.3.1 applies almost cleanly and I'm not seeing a change regarding the logging in the 6.4.0 changelog that could explain the issue is only present in the 6.4.x release.

https://gist.github.com/LeSuisse/f7ca44e2c0d0ba89c5530da5703be218

@NetaliDev
Copy link
Member Author

Ah okay. Then I will create a PR for stable with the mentioned commit as a patch. Thanks for the hint :)

@NetaliDev NetaliDev mentioned this pull request Jan 12, 2025
Merged
13 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@LeSuisse LeSuisse LeSuisse approved these changes

@Radvendii Radvendii Awaiting requested review from Radvendii

Assignees
No one assigned
Labels
1.severity: security Issues which raise a security issue, or PRs that fix one 10.rebuild-darwin: 0 This PR does not cause any packages to rebuild on Darwin 10.rebuild-linux: 1-10
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@NetaliDev @LeSuisse