diff --git a/doc/release-notes/rl-2605.section.md b/doc/release-notes/rl-2605.section.md index c535f35d21d6..e72d8eee657a 100644 --- a/doc/release-notes/rl-2605.section.md +++ b/doc/release-notes/rl-2605.section.md @@ -197,6 +197,8 @@ - `python3Packages.pikepdf` no longer builds with mupdf support by default, which may be nice in Jupyter and iPython. Build with `withMupdf = true` if this is required. +- `python3Packages.django-mdeditor` has been removed, as it was unmaintained upstream and the latest release was vulnerable to a [critical security vulnerability](https://github.com/NixOS/nixpkgs/issues/515462). + - `vicinae` has been updated to v0.20. This includes, among several other breaking changes, a complete overhaul of the configuration system. For update instructions, see the [upstream configuration documentation](https://docs.vicinae.com/config#migration-from-v0-16-x-to-v0-17-x). - `percona-server_8_4` has been removed. Please update to `percona-server_8_0`, `mysql84` or `mariadb`. diff --git a/pkgs/development/python-modules/django-mdeditor/Bump-KaTeX-and-replace-bootcdn-with-jsdelivr.patch b/pkgs/development/python-modules/django-mdeditor/Bump-KaTeX-and-replace-bootcdn-with-jsdelivr.patch deleted file mode 100644 index 28f7b182809f..000000000000 --- a/pkgs/development/python-modules/django-mdeditor/Bump-KaTeX-and-replace-bootcdn-with-jsdelivr.patch +++ /dev/null @@ -1,63 +0,0 @@ -From c5af641cccf663dffb4a47d32e28404f609badce Mon Sep 17 00:00:00 2001 -From: Tomo -Date: Sat, 12 Oct 2024 03:39:12 +0000 -Subject: [PATCH 1/2] chore(KaTeX): bump to 0.7.1 - -Many bugfixes. This KaTeX is still quite old, -but versions beyond this have backwards-incompatibilities -(starting in 0.8). ---- - mdeditor/static/mdeditor/js/editormd.js | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/mdeditor/static/mdeditor/js/editormd.js b/mdeditor/static/mdeditor/js/editormd.js -index be0005d..8aacb56 100644 ---- a/mdeditor/static/mdeditor/js/editormd.js -+++ b/mdeditor/static/mdeditor/js/editormd.js -@@ -4179,8 +4179,8 @@ - // 使用国外的CDN，加载速度有时会很慢，或者自定义URL - // You can custom KaTeX load url. - editormd.katexURL = { -- css : "//cdn.bootcdn.net/ajax/libs/KaTeX/0.3.0/katex.min", -- js : "//cdn.bootcdn.net/ajax/libs/KaTeX/0.3.0/katex.min" -+ css : "//cdn.bootcdn.net/ajax/libs/KaTeX/0.7.1/katex.min", -+ js : "//cdn.bootcdn.net/ajax/libs/KaTeX/0.7.1/katex.min" - }; - - editormd.kaTeXLoaded = false; --- -2.46.2 - - -From 3d082a738262b057d33b9aa8c777d50113143952 Mon Sep 17 00:00:00 2001 -From: Tomo -Date: Mon, 7 Oct 2024 17:44:39 -0700 -Subject: [PATCH 2/2] fix(KaTeX): Use jsdelivr instead of bootcdn - -Bootcdn was compromised by a malicious actor: -https://sansec.io/research/polyfill-supply-chain-attack - -KaTeX recommends using jsdelivr, so I used that: -https://katex.org/docs/browser ---- - mdeditor/static/mdeditor/js/editormd.js | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/mdeditor/static/mdeditor/js/editormd.js b/mdeditor/static/mdeditor/js/editormd.js -index 8aacb56..a31e817 100644 ---- a/mdeditor/static/mdeditor/js/editormd.js -+++ b/mdeditor/static/mdeditor/js/editormd.js -@@ -4179,8 +4179,8 @@ - // 使用国外的CDN，加载速度有时会很慢，或者自定义URL - // You can custom KaTeX load url. - editormd.katexURL = { -- css : "//cdn.bootcdn.net/ajax/libs/KaTeX/0.7.1/katex.min", -- js : "//cdn.bootcdn.net/ajax/libs/KaTeX/0.7.1/katex.min" -+ css : "//cdn.jsdelivr.net/npm/katex@0.7.1/dist/katex.min.css", -+ js : "//cdn.jsdelivr.net/npm/katex@0.7.1/dist/katex.min.js" - }; - - editormd.kaTeXLoaded = false; --- -2.46.2 - diff --git a/pkgs/development/python-modules/django-mdeditor/default.nix b/pkgs/development/python-modules/django-mdeditor/default.nix deleted file mode 100644 index d80f497386bd..000000000000 --- a/pkgs/development/python-modules/django-mdeditor/default.nix +++ /dev/null @@ -1,43 +0,0 @@ -{ - lib, - buildPythonPackage, - fetchFromGitHub, - django, -}: -let - version = "0.1.20"; -in -buildPythonPackage { - pname = "django-mdeditor"; - inherit version; - format = "setuptools"; - - src = fetchFromGitHub { - owner = "pylixm"; - repo = "django-mdeditor"; - rev = "v${version}"; - hash = "sha256-t57j1HhjNQtBwlbqe4mAHQ9WiNcIhMKYmrZkiqh+k5k="; - }; - - patches = [ - ./Bump-KaTeX-and-replace-bootcdn-with-jsdelivr.patch - ]; - - propagatedBuildInputs = [ django ]; - - # no tests - doCheck = false; - pythonImportsCheck = [ "mdeditor" ]; - - meta = { - description = "Markdown Editor plugin application for django based on Editor.md"; - homepage = "https://github.com/pylixm/django-mdeditor"; - changelog = "https://github.com/pylixm/django-mdeditor/releases"; - license = lib.licenses.gpl3; - maintainers = with lib.maintainers; [ augustebaum ]; - knownVulnerabilities = [ - # https://nvd.nist.gov/vuln/detail/CVE-2025-13030 - "CVE-2025-13030" - ]; - }; -} diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix index 2129278fdef1..a7520ae5352d 100644 --- a/pkgs/top-level/python-aliases.nix +++ b/pkgs/top-level/python-aliases.nix @@ -155,6 +155,7 @@ mapAliases { django-crispy-bootstrap4 = crispy-bootstrap4; # added 2025-06-11 django-crispy-bootstrap5 = crispy-bootstrap5; # added 2025-06-11 django-cryptography = throw "'django-cryptography' has been removed as it was unmaintained upstream"; # Added 2026-03-22 + django-mdeditor = throw "'django-mdeditor' has been removed as it was unmaintained upstream and the latest release was vulnerable"; # Added 2026-05-02 django-modelsearch = modelsearch; # added 2026-03-02 django_3 = throw "Django 3 has reached it's EOL in 2024-04 and has therefore been removed."; # added 2025-01-25 django_4 = throw "Django 4 has reached it's EOL in 2026-04 and has therefore been removed."; # added 2026-03-30 diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix index c1591754db31..d55902fe5911 100644 --- a/pkgs/top-level/python-packages.nix +++ b/pkgs/top-level/python-packages.nix @@ -4288,8 +4288,6 @@ self: super: with self; { django-mcp-server = callPackage ../development/python-modules/django-mcp-server { }; - django-mdeditor = callPackage ../development/python-modules/django-mdeditor { }; - django-mfa3 = callPackage ../development/python-modules/django-mfa3 { }; django-minify-html = callPackage ../development/python-modules/django-minify-html { };