mirror of
https://git.savannah.gnu.org/git/guix.git
synced 2026-04-06 13:10:33 +02:00
21946173a05869dd40a38012e65b9e35dc47a9fc
* gnu/packages/librewolf.scm (librewolf): Update to 149.0-1. Contains fixes for: CVE-2026-4684: Race condition, use-after-free in the Graphics: WebRender component CVE-2026-4685: Incorrect boundary conditions in the Graphics: Canvas2D component CVE-2026-4686: Incorrect boundary conditions in the Graphics: Canvas2D component CVE-2026-4687: Sandbox escape due to incorrect boundary conditions in the Telemetry component CVE-2026-4688: Sandbox escape due to use-after-free in the Disability Access APIs component CVE-2026-4689: Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component CVE-2026-4690: Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component CVE-2026-4691: Use-after-free in the CSS Parsing and Computation component CVE-2026-4692: Sandbox escape in the Responsive Design Mode component CVE-2026-4693: Incorrect boundary conditions in the Audio/Video: Playback component CVE-2026-4694: Incorrect boundary conditions, integer overflow in the Graphics component CVE-2026-4695: Incorrect boundary conditions in the Audio/Video: Web Codecs component CVE-2026-4696: Use-after-free in the Layout: Text and Fonts component CVE-2026-4697: Incorrect boundary conditions in the Audio/Video: Web Codecs component CVE-2026-4698: JIT miscompilation in the JavaScript Engine: JIT component CVE-2026-4699: Incorrect boundary conditions in the Layout: Text and Fonts component CVE-2026-4700: Mitigation bypass in the Networking: HTTP component CVE-2026-4701: Use-after-free in the JavaScript Engine component CVE-2026-4722: Privilege escalation in the IPC component CVE-2026-4702: JIT miscompilation in the JavaScript Engine component CVE-2026-4723: Use-after-free in the JavaScript Engine component CVE-2026-4724: Undefined behavior in the Audio/Video component CVE-2026-4704: Denial-of-service in the WebRTC: Signaling component CVE-2026-4705: Undefined behavior in the WebRTC: Signaling component CVE-2026-4706: Incorrect boundary conditions in the Graphics: Canvas2D component CVE-2026-4707: Incorrect boundary conditions in the Graphics: Canvas2D component CVE-2026-4708: Incorrect boundary conditions in the Graphics component CVE-2026-4709: Incorrect boundary conditions in the Audio/Video: GMP component CVE-2026-4710: Incorrect boundary conditions in the Audio/Video component CVE-2026-4711: Use-after-free in the Widget: Cocoa component CVE-2026-4725: Sandbox escape due to use-after-free in the Graphics: Canvas2D component CVE-2026-4712: Information disclosure in the Widget: Cocoa component CVE-2026-4713: Incorrect boundary conditions in the Graphics component CVE-2026-4714: Incorrect boundary conditions in the Audio/Video component CVE-2026-4715: Uninitialized memory in the Graphics: Canvas2D component CVE-2026-4716: Incorrect boundary conditions, uninitialized memory in the JavaScript Engine component CVE-2026-4717: Privilege escalation in the Netmonitor component CVE-2026-4726: Denial-of-service in the XML component CVE-2025-59375: Denial-of-service in the XML component CVE-2026-4727: Denial-of-service in the Libraries component in NSS CVE-2026-4728: Spoofing issue in the Privacy: Anti-Tracking component CVE-2026-4718: Undefined behavior in the WebRTC: Signaling component CVE-2026-4719: Incorrect boundary conditions in the Graphics: Text component CVE-2026-4720: Memory safety bugs fixed in Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149 CVE-2026-4729: Memory safety bugs fixed in Firefox 149 and Thunderbird 149 CVE-2026-4721: Memory safety bugs fixed in Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and hunderbird 149 Change-Id: I40e76bf852087d71f8df869103c846032e8552c9 Signed-off-by: Ian Eure <ian@retrospec.tv>
…
…
…
…
…
…
…
…
…
…
This file contains invisible Unicode characters
This file contains invisible Unicode characters that are indistinguishable to humans but may be processed differently by a computer. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
-*- mode: org -*- [[https://www.gnu.org/software/guix/][GNU Guix]] (IPA: /ɡiːks/) is a purely functional package manager, and associated free software distribution, for the [[https://www.gnu.org/gnu/gnu.html][GNU system]]. In addition to standard package management features, Guix supports transactional upgrades and roll-backs, unprivileged package management, per-user profiles, and garbage collection. It provides [[https://www.gnu.org/software/guile/][Guile]] Scheme APIs, including a high-level embedded domain-specific languages (EDSLs) to describe how packages are to be built and composed. GNU Guix can be used on top of an already-installed GNU/Linux distribution, or it can be used standalone (we call that “Guix System”). Guix is based on the [[https://nixos.org/nix/][Nix]] package manager. * Requirements If you are building Guix from source, please see the manual for build instructions and requirements, either by running: info -f doc/guix.info "Requirements" or by checking the [[https://guix.gnu.org/manual/en/html_node/Requirements.html][web copy of the manual]]. * Installation See the manual for the installation instructions, either by running info -f doc/guix.info "Installation" or by checking the [[https://guix.gnu.org/manual/en/html_node/Installation.html][web copy of the manual]]. * Building from Git For information on building Guix from a Git checkout, please see the relevant section in the manual, either by running info -f doc/guix.info "Building from Git" or by checking the [[https://guix.gnu.org/manual/en/html_node/Building-from-Git.html][web_copy of the manual]]. * How It Works Guix does the high-level preparation of a /derivation/. A derivation is the promise of a build; it is stored as a text file under =/gnu/store/xxx.drv=. The (guix derivations) module provides the `derivation' primitive, as well as higher-level wrappers such as `build-expression->derivation'. Guix does remote procedure calls (RPCs) to the build daemon (the =guix-daemon= command), which in turn performs builds and accesses to the store on its behalf. The RPCs are implemented in the (guix store) module. * Contact GNU Guix is hosted at https://codeberg.org/guix/guix/. Please email mailto:help-guix@gnu.org for questions. Bug reports should be submitted via https://codeberg.org/guix/guix/issues/. Email mailto:gnu-system-discuss@gnu.org for general issues regarding the GNU system. Join #guix on irc.libera.chat. * Guix & Nix GNU Guix is based on [[https://nixos.org/nix/][the Nix package manager]]. It implements the same package deployment paradigm, and in fact it reuses some of its code. Yet, different engineering decisions were made for Guix, as described below. Nix is really two things: a package build tool, implemented by a library and daemon, and a special-purpose programming language. GNU Guix relies on the former, but uses Scheme as a replacement for the latter. Using Scheme instead of a specific language allows us to get all the features and tooling that come with Guile (compiler, debugger, REPL, Unicode, libraries, etc.) And it means that we have a general-purpose language, on top of which we can have embedded domain-specific languages (EDSLs), such as the one used to define packages. This broadens what can be done in package recipes themselves, and what can be done around them. Technically, Guix makes remote procedure calls to the ‘nix-worker’ daemon to perform operations on the store. At the lowest level, Nix “derivations” represent promises of a build, stored in ‘.drv’ files in the store. Guix produces such derivations, which are then interpreted by the daemon to perform the build. Thus, Guix derivations can use derivations produced by Nix (and vice versa). With Nix and the [[https://nixos.org/nixpkgs][Nixpkgs]] distribution, package composition happens at the Nix language level, but builders are usually written in Bash. Conversely, Guix encourages the use of Scheme for both package composition and builders. Likewise, the core functionality of Nix is written in C++ and Perl; Guix relies on some of the original C++ code, but exposes all the API as Scheme. * Related software - [[https://nixos.org][Nix, Nixpkgs, and NixOS]], functional package manager and associated software distribution, are the inspiration of Guix - [[https://www.gnu.org/software/stow/][GNU Stow]] builds around the idea of one directory per prefix, and a symlink tree to create user environments - [[https://www.pvv.ntnu.no/~arnej/store/storedoc_6.html][STORE]] shares the same idea - [[https://live.gnome.org/OSTree/][GNOME's OSTree]] allows bootable system images to be built from a specified set of packages - The [[https://www.gnu.org/s/gsrc/][GNU Source Release Collection]] (GSRC) is a user-land software distribution; unlike Guix, it relies on core tools available on the host system * Copyright Notices GNU Guix is made available under the GNU GPL version 3 or later license, and authors retain their copyright. For copyright notices, we adhere to the guidance documented in (info "(maintain) Copyright Notices"), and explicitly allow ranges instead of individual years. Here's an example of the preferred style used for copyright notices in source file headers: #+begin_comment Copyright © 2019-2023, 2025 Your Name <your@email.com> #+end_comment Meaning there were copyright-able changes made for the years 2019, 2020, 2021, 2022, 2023 and 2025.
Description
Languages
Scheme
98.2%
C++
0.8%
Shell
0.5%
Makefile
0.3%