Skip to content

matrix-synapse: 1.23.0 -> 1.24.0, element-*: 1.7.14 -> 1.7.15#106436

Merged
Ma27 merged 3 commits intoNixOS:masterfrom
Ma27:matrix-updates
Dec 9, 2020
Merged

matrix-synapse: 1.23.0 -> 1.24.0, element-*: 1.7.14 -> 1.7.15#106436
Ma27 merged 3 commits intoNixOS:masterfrom
Ma27:matrix-updates

Conversation

@Ma27
Copy link
Member

@Ma27 Ma27 commented Dec 9, 2020

Motivation for this change

ChangeLogs:

Please note that matrix-synapse 1.24 has two advisories for CVE-2020-26257 and CVE-2020-1971. The latter one got fixed in #106362, the first one is fixed in this update.

Things done
  • Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS linux)
  • Built on platform(s)
    • NixOS
    • macOS
    • other Linux distributions
  • Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
  • Tested compilation of all pkgs that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review wip"
  • Tested execution of all binary files (usually in ./result/bin/)
  • Determined the impact on package closure size (by running nix path-info -S before and after)
  • Ensured that relevant documentation is up to date
  • Fits CONTRIBUTING.md.

Ma27 added 3 commits December 9, 2020 12:26
@Ma27
element-desktop: 1.7.14 -> 1.7.15
db6c4b1 
ChangeLog: https://github.com/vector-im/element-desktop/releases/tag/v1.7.15
@Ma27
element-web: 1.7.14 -> 1.7.15
0d5608d 
ChangeLog: https://github.com/vector-im/element-web/releases/tag/v1.7.15

Also had to replace `riot` with `element` in the download URL now as the
artifacts were renamed in this release.
@Ma27
matrix-synapse: 1.23.0 -> 1.24.0
917cac4 
ChangeLog: https://github.com/matrix-org/synapse/releases/tag/v1.24.0

This release contains two security advisories:

* CVE-2020-26257[1]: possible DDoS in the federation API.
* CVE-2020-1971[2]: to be fixed in NixOS#106362[3].

[1] https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-26257
[2] https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1971
[3] NixOS#106362
@Ma27 Ma27 added 1.severity: security Issues which raise a security issue, or PRs that fix one 9.needs: port to stable A PR needs a backport to the stable release. labels Dec 9, 2020
@ofborg ofborg bot added 11.by: package-maintainer This PR was created by a maintainer of all the package it changes. 10.rebuild-darwin: 1-10 This PR causes between 1 and 10 packages to rebuild on Darwin. 10.rebuild-linux: 1-10 This PR causes between 1 and 10 packages to rebuild on Linux. labels Dec 9, 2020
@bachp bachp mentioned this pull request Dec 9, 2020
Closed
drewrisinger
drewrisinger approved these changes Dec 9, 2020
View reviewed changes
Copy link
Contributor

@drewrisinger drewrisinger left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

  • Diff LGTM
  • Commits LGTM
  • Builds via nix-review:
https://github.com/NixOS/nixpkgs/pull/106436
2 packages built:
element-desktop matrix-synapse

@Ma27 Ma27 merged commit ace2457 into NixOS:master Dec 9, 2020
@Ma27 Ma27 deleted the matrix-updates branch December 9, 2020 18:13
@Ma27
Copy link
Member Author

Ma27 commented Dec 9, 2020

Ported to stable as bed79c3, 6dd112c, e9140b1.

@Ma27 Ma27 added 8.has: port to stable This PR already has a backport to the stable release. and removed 9.needs: port to stable A PR needs a backport to the stable release. labels Dec 9, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@bachp bachp bachp approved these changes

@Ralith Ralith Awaiting requested review from Ralith

@Ekleog Ekleog Awaiting requested review from Ekleog

@mguentner mguentner Awaiting requested review from mguentner

@ajs124 ajs124 Awaiting requested review from ajs124

@pacien pacien Awaiting requested review from pacien

+3 more reviewers

@fadenb fadenb fadenb approved these changes

@D4ndellion D4ndellion D4ndellion approved these changes

@drewrisinger drewrisinger drewrisinger approved these changes

Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

1.severity: security Issues which raise a security issue, or PRs that fix one 8.has: port to stable This PR already has a backport to the stable release. 10.rebuild-darwin: 1-10 This PR causes between 1 and 10 packages to rebuild on Darwin. 10.rebuild-linux: 1-10 This PR causes between 1 and 10 packages to rebuild on Linux. 11.by: package-maintainer This PR was created by a maintainer of all the package it changes.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@Ma27 @bachp @fadenb @D4ndellion @drewrisinger