_give a man a feature and he 'll take months to deploy it, show a man a CVE and 
he'll fix it and deploy everything ASAP_

A new deployment of the forum has been due for a while now, some wonderful bug 
fixes and new features were introduced, but what really pushed things was a 
brand new exploit that @nnsee has found. So NimForum 2.2.0 not only brings 
stickied threads, but also many important fixes to Nim's RST parser, [fixing 
both potentially malicious links](https://github.com/nim-lang/Nim/pull/19134) 
and [the ability to include local 
files](https://github.com/nim-lang/nimforum/security/advisories/GHSA-q3vh-x957-wr75)
 of the server the forum is running on(!)

If you're running your own instance of the NimForum or are using Nim's rst 
parser to render user-provided text then you will need to upgrade ASAP. 
Hopefully my patch for the RST parser will be merged into `devel` soon. If 
anyone needs the patch faster feel free to ask.

For a full list of changes check out: 
<https://github.com/nim-lang/nimforum/compare/v2.1.0...v2.2.0>.

In addition, this release has been compiled with the latest and greatest Nim 
compiler and related libraries (for example HttpBeast 0.4.0). As usual, please 
keep an eye out for any weirdness and report it on the NimForum's issue tracker.

Reply via email to