The Wire · Showcase
FEEDPARSER PATCHES SGMLLIB, BENCODE ADDS DEPTH LIMITS
By RepoJournal · Filed · About Arch Linux
Arch's package ecosystem rolls forward with security and stability patches across two critical desks, 50 commits across the state.
Feedparser jumped to v6.0.14 with an upgrade to feedparser-sgmllib 2.0.0 [1], closing out the release cycle that dropped Python 3.8 support in v6.0.13. In parallel, bencode-py shipped v4.1.0 with a new safeguard: the decoder now limits structure depth to a maximum of 100 [2], a defensive move against pathological nested inputs that could choke parsers. Over on the state side, City-busz pushed four package bumps including rednotebook 2.42 through two iterations [7] [4], gnome-shell-extension-desktop-icons-ng 51.0.4 [5], and python-rarfile 4.5 [6], while Integral-Tech landed libgbinder 1.1.51 in extra-x86_64 [3]. The archweb dependency chain tightens while the package state moves forward on schedule.
One email a day. Unsubscribe in one click.
Keep up with Arch Linux in about 3 minutes a day: what actually shipped — the commits, pull requests, releases, and security advisories that matter.
One email a day. Unsubscribe in one click. Read a past issue →
Action items
- → Pull feedparser 6.0.14 into next archweb deploy archlinux/archweb [plan]
- → Verify bencode-py 4.1.0 compatibility in torrent parsing flows archlinux/archweb [monitor]
- → Roll package updates from state into your systems archlinux/state [plan]
References
- [1] build(deps): bump feedparser from 6.0.12 to 6.0.14 ↗ archlinux/archweb
- [2] build(deps): bump bencode-py from 4.0.0 to 4.1.0 ↗ archlinux/archweb
- [3] update libgbinder to 1.1.51-1 in extra-x86_64 archlinux/state
- [4] update rednotebook to 2.42-3 in extra-any archlinux/state
- [5] update gnome-shell-extension-desktop-icons-ng to 51.0.4-1 in extra-any archlinux/state
- [6] update python-rarfile to 4.5-1 in extra-any archlinux/state
- [7] update rednotebook to 2.42-2 in extra-any archlinux/state