Re: RFC: ruby-loofah 2.2.3-1+deb10u2

2023-03-21 Thread Daniel Leidert
Hey Utkarsh, Am Freitag, dem 17.03.2023 um 01:23 +0100 schrieb Daniel Leidert: > Am Freitag, dem 17.03.2023 um 04:58 +0530 schrieb Utkarsh Gupta: [..] > > > I could do a thorough review of your patches if you'd like? > > Sure, please do so. Any news about this? Regards, Daniel

Re: RFC: ruby-loofah 2.2.3-1+deb10u2

2023-03-16 Thread Daniel Leidert
Am Freitag, dem 17.03.2023 um 04:58 +0530 schrieb Utkarsh Gupta: > On Thu, Mar 16, 2023 at 7:06 PM Utkarsh Gupta > wrote: > > Please hold off on the update for a while. I have something to add wrt > > ruby-rails-html-sanitizer. I just haven't had the time to write it > > down, I'll get back in

Re: RFC: ruby-loofah 2.2.3-1+deb10u2

2023-03-16 Thread Utkarsh Gupta
Hi Daniel, On Thu, Mar 16, 2023 at 7:06 PM Utkarsh Gupta wrote: > Please hold off on the update for a while. I have something to add wrt > ruby-rails-html-sanitizer. I just haven't had the time to write it > down, I'll get back in another ~7h. In order to fix the CVEs of

Re: RFC: ruby-loofah 2.2.3-1+deb10u2

2023-03-16 Thread Utkarsh Gupta
Hi Daniel, On Thu, Mar 16, 2023 at 3:01 AM Daniel Leidert wrote: > I'll wait another day for feedback and then go ahead with the upload. Please hold off on the update for a while. I have something to add wrt ruby-rails-html-sanitizer. I just haven't had the time to write it down, I'll get back

Re: RFC: ruby-loofah 2.2.3-1+deb10u2

2023-03-15 Thread Daniel Leidert
Am Mittwoch, dem 15.03.2023 um 12:34 +0100 schrieb Emilio Pozuelo Monfort: [..] > > > > What do you think? I wonder if that is an acceptable change? > > Without looking in detail, my question would be: > > Is the output change likely to cause issues to loofah users? If not, then > keep > the

Re: RFC: ruby-loofah 2.2.3-1+deb10u2

2023-03-15 Thread Emilio Pozuelo Monfort
Hi Daniel, On 13/03/2023 23:18, Daniel Leidert wrote: Hi there, I prepared my first LTS update. You can find it here: https://salsa.debian.org/lts-team/packages/ruby-loofah When I ran some test cases to see if all the vulnerabilities are fixed, I discovered that there is a slight behavioral

Re: RFC: ruby-loofah 2.2.3-1+deb10u2

2023-03-14 Thread Daniel Leidert
Am Dienstag, dem 14.03.2023 um 11:34 +0100 schrieb Daniel Leidert: > Am Dienstag, dem 14.03.2023 um 06:11 +0100 schrieb Anton Gladky: > > [..] > > 3) Please check, why piuparts is failing on CI. > > I have already yesterday, and I wasn't able to reproduce that (the log > is also not clear about

Re: RFC: ruby-loofah 2.2.3-1+deb10u2

2023-03-14 Thread Daniel Leidert
Hi Anton, thanks for your feedback. Am Dienstag, dem 14.03.2023 um 06:11 +0100 schrieb Anton Gladky: > Hi Daniel, > > congratulations on your first update! > > Some notes: > > 1) to be consistent with all other updates please do not add the suffix > in the version number I'm not quite sure

Re: RFC: ruby-loofah 2.2.3-1+deb10u2

2023-03-13 Thread Anton Gladky
Hi Daniel, congratulations on your first update! Some notes: 1) to be consistent with all other updates please do not add the suffix in the version number 2) t is not quite a team upload. Better use "dch --lts" which converts to "* Non-maintainer upload by the LTS Security Team." 3) Please

RFC: ruby-loofah 2.2.3-1+deb10u2

2023-03-13 Thread Daniel Leidert
Hi there, I prepared my first LTS update. You can find it here: https://salsa.debian.org/lts-team/packages/ruby-loofah When I ran some test cases to see if all the vulnerabilities are fixed, I discovered that there is a slight behavioral change: As part of the fix for CVE-2022-23516, loofah