| 6 Jun 2021 |
|  Henson joined the room. | 01:55:09 |
 ris_ | wanna make it 261? https://github.com/NixOS/nixpkgs/pull/125233 | 10:55:44 |
| ris_ | or even 262? https://github.com/NixOS/nixpkgs/pull/125088 | 10:56:17 |
 hexa | Interested, but only at home later tonight | 12:36:00 |
| 7 Jun 2021 |
| Henson | I've got a question about the postgresql_11 package. A couple weeks ago there was a security update announcement in the Debian security mailing list recommending to upgrade from 11.11 to 11.12 due to several bug fixes. I notice that NixOS's postgres_11 package is still at 11.11 in 20.09 and 21.05. Is there a reason this hasn't been bumped to 11.12 yet? | 12:34:14 |
| Henson | this is coming from the perspective of somebody who doesn't know much about the NixOS security team and is interested in understanding things better. | 12:38:47 |
|  ldesgoui joined the room. | 12:39:00 |
| hexa | Fixed in https://github.com/NixOS/nixpkgs/pull/125751, needs to go through the channels I'd imagine | 13:29:17 |
| hexa | https://nixpk.gs/pr-tracker.html?pr=125751 | 13:29:36 |
 Sandro | Yeah, mass rebuild | 13:30:16 |
| Sandro | Is 11 the default version? If not we can maybe cherry pick it | 13:30:34 |
| Henson | hexa: thanks for pointing that out, I looked in the issues for it but didn't look in the PRs. | 13:54:30 |
| Henson | Sandro: so if postgres_11 gets bumped from 11.11 to 11.12, then all packages that have postgres_11 in their closure have to get rebuilt, right? | 13:57:48 |
| Henson | and postgres_11 = postgres is the default postgres for NixOS | 13:58:43 |
| Henson | oops %s/postgres/postgresql/g | 13:59:12 |
| hexa | https://github.com/NixOS/nixpkgs/pull/126088 https://github.com/NixOS/nixpkgs/pull/126089 | 16:15:49 |
| hexa | possible remote code execution in isync/mbsync | 16:16:01 |
| Sandro | In reply to @henson:matrix.org
Sandro: so if postgres_11 gets bumped from 11.11 to 11.12, then all packages that have postgres_11 in their closure have to get rebuilt, right? yes | 16:35:26 |
| 8 Jun 2021 |
|  dualinverter left the room. | 08:41:37 |
| hexa | https://nvd.nist.gov/vuln/detail/CVE-2021-3514 | 11:13:42 |
| hexa | the package looks unmaintained, only carried ahead by treewide changes, maybe a candidate for removal … | 11:14:05 |
 das_j | 389 was a Totgeburt imo (don't know an english term for that). I have never heard anyone use it | 11:31:58 |
| das_j | * 389 was a Totgeburt imo (don't know an english term for that). I have never heard anyone use it. Only some considered switching but nobody really did | 11:32:18 |
|  kranzes joined the room. | 11:37:47 |
| hexa | stillborn/stillbirth | 11:37:56 |
| das_j | yeah | 11:38:15 |
 Linux Hackerman | Unpleasant metaphor to use for it IMHO though. | 11:38:18 |
| hexa | indeed | 11:38:22 |
| das_j | yeah, I really didn't think about the actual meaning of it | 11:38:38 |
| das_j | * yeah, I really didn't think about the actual meaning of it, sorry | 11:38:49 |
