$ the-wire · showcase
FEEDPARSER PATCHES SGMLLIB, BENCODE ADDS DEPTH LIMITS
By RepoJournal · Filed · About Arch Linux · Composed from the cited sources · methodology
Arch's package ecosystem rolls forward with security and stability patches across two critical desks, 50 commits across the state.
Feedparser jumped to v6.0.14 with an upgrade to feedparser-sgmllib 2.0.0 [1], closing out the release cycle that dropped Python 3.8 support in v6.0.13. In parallel, bencode-py shipped v4.1.0 with a new safeguard: the decoder now limits structure depth to a maximum of 100 [2], a defensive move against pathological nested inputs that could choke parsers. Over on the state side, City-busz pushed four package bumps including rednotebook 2.42 through two iterations [7] [4], gnome-shell-extension-desktop-icons-ng 51.0.4 [5], and python-rarfile 4.5 [6], while Integral-Tech landed libgbinder 1.1.51 in extra-x86_64 [3]. The archweb dependency chain tightens while the package state moves forward on schedule.
Action items
- → Pull feedparser 6.0.14 into next archweb deploy archlinux/archweb [plan]
- → Verify bencode-py 4.1.0 compatibility in torrent parsing flows archlinux/archweb [monitor]
- → Roll package updates from state into your systems archlinux/state [plan]
References
- [1] build(deps): bump feedparser from 6.0.12 to 6.0.14 ↗ archlinux/archweb
- [2] build(deps): bump bencode-py from 4.0.0 to 4.1.0 ↗ archlinux/archweb
- [3] update libgbinder to 1.1.51-1 in extra-x86_64 archlinux/state ↗
- [4] update rednotebook to 2.42-3 in extra-any archlinux/state ↗
- [5] update gnome-shell-extension-desktop-icons-ng to 51.0.4-1 in extra-any archlinux/state ↗
- [6] update python-rarfile to 4.5-1 in extra-any archlinux/state ↗
- [7] update rednotebook to 2.42-2 in extra-any archlinux/state ↗