Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update pin to hdf5 1.8.18 #394

Merged
merged 1 commit into from
Jun 2, 2017
Merged

Update pin to hdf5 1.8.18 #394

merged 1 commit into from
Jun 2, 2017

Conversation

qwhelan
Copy link
Contributor

@qwhelan qwhelan commented Jun 2, 2017

Update hdf5 to 1.8.18 to resolve some CVEs announced back in November.

See conda-forge/hdf5-feedstock#71 for more info.

@@ -41,7 +41,7 @@
'glib': 'glib 2.51.*', # 2.50.2
'gmp': 'gmp >=5.0.1,<7', # 6.1.0
'harfbuzz': 'harfbuzz 1.3.*', # 0.9.39
'hdf5': 'hdf5 1.8.17|1.8.17.*', # 1.8.17
'hdf5': 'hdf5 1.8.18|1.8.18.*', # 1.8.17
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@jjhelmus can you confirm if defaults version is still 1.8.17?

(It is probably safe for conda-forge to move to 1.8.18 b/c we do have all the packages that uses hdf5 packaged in conda-forge.)

Copy link
Contributor Author

@qwhelan qwhelan Jun 2, 2017

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It is still 1.8.17 - I have a PR to update it here: ContinuumIO/anaconda-recipes#109

In my experience, my PRs get ignored even if it's about a remote code execution vuln.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@qwhelan are you referring to defaults or conda-forge? I am confused b/c you linked the PR to conda-forge, but that was merged and we are moving to the latest hdf5 thanks to you.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@ocefpaf Apologies, pasted the wrong link initially. I was referring to defaults

@ocefpaf ocefpaf merged commit a9a62da into conda-forge:master Jun 2, 2017
@qwhelan qwhelan deleted the hdf5_pin branch June 2, 2017 18:34
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

Successfully merging this pull request may close these issues.

2 participants