| 17 May 2025 |
 Alyssa Ross | Still looking for Darwin testing on the Meson upgrade https://github.com/NixOS/nixpkgs/pull/402752 | 08:37:33 |
| Alyssa Ross | But this is the wrong room | 08:44:58 |
 ma27 | OK we don't have to do anything btw: the advisory states
Fix-Commit: 5451fa962cd0a90a0e2ec1d8910a559ace02bba0 (2.39)
the commit is from 2023 and part of the glibc we're shipping. | 08:58:36 |
 K900 | https://github.com/google/security-research/security/advisories/GHSA-qx2m-rcpc-v43v | 12:23:49 |
| K900 | Ayylmao | 12:24:09 |
 tgerbet | Fixed in https://github.com/NixOS/nixpkgs/pull/400278 and https://github.com/NixOS/nixpkgs/pull/403432
It looks like they did not update the fixed version field in the advisory | 12:26:11 |
| K900 | Ayylmao, but different | 12:27:29 |
 Grimmauld (any/all) | https://github.com/NixOS/nixpkgs/pull/401409
I still have an open security fix PR that noone seems to want to review... | 14:29:27 |
|  oddlama changed their display name from oddlama to Malte. | 20:12:23 |
| 18 May 2025 |
| K900 | https://www.mozilla.org/en-US/security/advisories/mfsa2025-36/ | 14:06:39 |
| K900 | @hexa:lossy.network | 14:06:43 |
 linj | fixed in https://github.com/NixOS/nixpkgs/pull/408236 | 14:07:52 |
| K900 | Cool | 14:08:29 |
 hexa | still testing on 24.11 | 14:08:58 |
| 19 May 2025 |
| Grimmauld (any/all) | Can we get a merge on https://github.com/NixOS/nixpkgs/pull/408524? Its analogous to the firefox update and i'd really rather have that.... Yes yes, we are on topic with browser forks, but i can't commit this (yet) | 14:56:55 |
|  oak 🏳️🌈♥️ changed their display name from oak 🫱⭕🫲 to oak. | 10:59:05 |
| hexa | note that we started requiring an active committer on the maintainers list for browsers cough | 14:57:48 |
| oak 🏳️🌈♥️ changed their display name from oak to oak 🏳️🌈♥️. | 11:00:52 |
 emily | only for new ones, I think | 14:58:09 |
| hexa | * note that we started requiring an active committer on the maintainers list for browsers 😉 | 14:58:33 |
| hexa | nope, we don't do grandfathering for security | 14:58:47 |
| Grimmauld (any/all) |
I agree that different standards for new vs. existing packages doesn't make sense
make me committer then :P
| 14:59:02 |
| hexa | smh | 14:59:13 |
| hexa | #security-discuss:nixos.org if you want to continue the banter 😜 | 14:59:47 |
|  Emantor changed their profile picture. | 19:32:12 |
| 20 May 2025 |
| emily | https://github.com/NixOS/nixpkgs/pull/409063 https://github.com/NixOS/nixpkgs/pull/409064 | 13:12:40 |
| emily | "Patches to fix CVE-2017-12921 and CVE-2017-12925 and possibly CVE-2017-12920." always a good time when the changelog isn't even sure they fixed the CVE | 13:13:06 |
| hexa | this is imagemagick, you can always assume a vulnerability lingering | 13:16:33 |
| emily | (fixed aliases merge conflict 🙃) | 13:24:32 |
