[LyX/2.5.x] Prepare for 2.5.2

commit de6957f648f01efad586a56713d45ff0e49f1c43
Author: Richard Kimberly Heck <[email protected]>
Date:   Tue Jul 28 11:03:46 2026 -0400

    Prepare for 2.5.2
---
 ANNOUNCE     | 137 ++++++++++++++++++++++++++++++++++++++---------------------
 NEWS         |  13 ++++++
 configure.ac |   4 +-
 3 files changed, 104 insertions(+), 50 deletions(-)

diff --git a/ANNOUNCE b/ANNOUNCE
index 43ddcc8c36..7d654ef151 100644
--- a/ANNOUNCE
+++ b/ANNOUNCE
@@ -1,21 +1,27 @@
-Public release of LyX version 2.5.1
+Public release of LyX version 2.5.2
 ===================================
 
-We are proud to announce the release the LyX 2.5.1, the first maintenance
+We are pleased to announce the release the LyX 2.5.2, the second maintenance
 release in the 2.5.x series.
 
-This release fixes a number of mostly minor bugs in 2.5.0. One important fix
-concerns crashes when exiting LyX on OSX, specifically when documents are still
-open. We have also fixed a handful of bugs with the new input method support.
-If you should encounter any more, please do let us know.
+This release is somewhat special. Apart from usual bag of bugfixes we also
+include number of fixes to vulnerabilities dicovered in cooperation with AI
+tools.
 
-If a file from an earlier version of LyX is opened *and saved* with any version
-of 2.5.x, then the original file will automatically be backed up. The backup
-file will be found in the backup directory, if one is set under
-Tools> Preferences> Paths
-or else in the same folder as the original file, if no backup directory is set.
+We strongly urge our users to upgrade from previous releases, especially
+if they routinely use/exchange .lyx documents with external parties.
+In previous versions of LyX, malformed .lyx documents can cause arbitrary
+execution of shell commands upon .lyx load or within export processing.
 
-If you think you may have found a bug in LyX 2.5.1, either email the developers'
+As the capabilities of frontier AI models quickly develop this might not
+be the last such release and we suggest that users employ extreme caution
+when dealing with files from untrusted sources.
+
+This release fixes a number of mostly minor bugs in 2.5.1. One important fix
+solves the regression introduced in 2.5.1 which caused LyX not to store Qt
+session configuration (e.g. size and position of windows).
+
+If you think you may have found a bug in LyX 2.5.2, either email the developers'
 mailing list (lyx-devel at lists.lyx.org), or open a bug report at
   https://www.lyx.org/trac/wiki/BugTrackerHome
 Please specify if the behavior you are reporting is different from behavior in
@@ -31,36 +37,71 @@ https://wiki.lyx.org/. You can also send email to the LyX users' list
 The LyX team.
 https://www.lyx.org
 
+
 What's new
 ==========
 
 ** Updates:
 ***********
 
+* SECURITY HARDENING FIXES
+
+- Load-triggered arbitrary command execution vulnerabilities fixes:
+   - 00a: kpsewhich shell injection via filename
+   - 00b: lyx2lyx shell injection via filename
+   - 00c: graphics-extension name shell injection
+   - 00h: import-path filename shell injection into converters
+
+- Export/View triggered arbitrary command execution vulnerabilities fixes:
+   - 00d: bibtex command shell injection
+   - 00e: index command shell injection
+   - 00g: mangled filenames shell injection
+   - 00i: convert-pdf helper shell injection
+   - 00k: paperwidth/height injection causing arbitrary files rewrite
+
+- New consent authorization gate for unpatched external tools
+  - 00de:  processing gate prompts before running a code-capable bib/index tools
+           (biber/xindy/xindex) on an untrusted document,
+           The real fixes are upstream (biber 2.22, xindex 1.07, xindy from up-to-date
+           TL tree), while the gate is LyX's interim guard.
+           For biber 2.22 the gate automatically relaxes to no-op.
+  - 00de-2: xindex version check relaxing the gate above.
+
+
 * DOCUMENT INPUT/OUTPUT
 
-- Support the Sioyek PDF viewer.
+- Issue an error on @ catcode mismatch by layout definitions (bug 13275)
 
 
-* USER INTERFACE
+* MISCELLANEOUS
+
+- LyX now supports the Elsevier CAS classes.
+
+* TEX2LYX IMPROVEMENTS
+
+- Add support for \colorlet if the second arg is a known LaTeX or custom
+  color (bug 13310).
 
--  Enable dark/light mode preference setting on Linux.
-   This is supported at least for QT_QPA_PLATFORMTHEME=gtk3 (bug 12224).
 
+* USER INTERFACE
 
-* DOCUMENTATION AND LOCALIZATION
+- Implement LFUN_REFERENCE_TO_PARAGRAPH for mathed (bug 13206).
 
-- Update the KOMA-Letter (v. 2) template.
+- It is now possible in the tabular creation dialog (Inset > Table) to
+  insert a multi-page table (optionally with caption) directly.
 
-- Add a German KOMA-Letter (v. 2) template.
+- Simple search within selection now remembers the initial selection
+  beyond the first match (bug 13293).
 
-- Update Brazilian Portuguese, Czech, Dutch, German, Italian, Japanese, and
-  Slovak translations.
+- Fix session information not being properly restored. This regression
+  introduced was introduced in 2.5.1 as a side effect of fixing macOS
+  crash on exit and new fix should fix both issues.
 
 
 * BUILD/INSTALLATION
 
-- Accept macos SDKs with version 20 and higher to build bundle package.
+- Use inkscape as fallback png->eps converter if ImageMagick is not
+  available or IM policy does not allow for png->eps conversion.
 
 
 
@@ -69,52 +110,52 @@ What's new
 
 * DOCUMENT INPUT/OUTPUT
 
-- Fix an assertion caused by the new Input Method implementation in relation to
-  the change of work area.
+- Fix problem with nesting of languages.
+
+- Fix closing of local CJK language with polyglossia (bug 13315).
 
-- Properly resolve font in insets that do not inherit font (bug 13278).
+- Prevent duplicate theorem definitions (bug 13302).
 
-- Fix switch of text direction with verbatim content (bug 6373).
+- Fix case where the colortbl package has been loaded unnecessarily
+  (bug 13306).
 
-- Fix several cases where language begin/end commands have not been
-  properly nested when "Set document language explicitly" or
-  "Unset document language explicitly" have been selected in preferences.
+- Fix order of theorem definitions for pandoc processing (bug 13307).
 
-- Fix old docbook layouts.
+- Fix support for import/export of ODT documents using pandoc.
 
 
 * USER INTERFACE
 
-- Fix crash in mathed when using cursor right to end the input of
-  macro names like \alpha.
+- Fix crash when selecting inset (bug 13294).
 
-- Fix crash when quitting LyX on recent macOS versions.
+- Fix assertion when closing buffer with listings settings dialog open.
 
-- Fix cross-references dialog in mathed (bug 13285).
+- Consider longtable caption when adding new column (bug 13299).
 
-- Fix pasting of partial math grids (bug 13277).
+- Load externally referred buffers and initialize their labels.
 
-- Fix logic of auto-insertion to argument insets (part of 12364).
+- Fix pasting of cross-references in math (bug 13290).
 
-- Automatically insert overlay argument of beamer layouts (part of 12364).
+- Fix pasting from LaTeX with keepEmpty environment in first paragraph
+  (bug 13295).
 
-- Fix empty paragraph check in pasting (bug 13281).
+- Fix casing of strings in English localization (bug 13304).
 
-- Do not allow to split InsetArgument which does not make sense.
+- Fix background color drawing for non-center aligned tabular cells.
 
-- Fix initial value of custom color dialog.
+- Fix on-screen representation of "pagewidth" length (bug 13309).
 
-- Build InsetInfo info also when inset is hidden in collapsible (bug 13280).
+- Fix sorting of colors in preferences.
 
-- Fix computer algebra system bug: converting the displayed math
-  into eqnarray* environment (bug 13247).
+- Fix zoom-in/out functions so that the inverse (e.g. with the mouse wheel)
+  end up at the exact same value (bug 13327).
 
-- Fix PDF->PNG conversion problem on macOS. Now gs takes priority over sips
-  on that os (bug 12632).
 
-- Reintroduce a proper version of a broken optimization that was removed for 2.5.0.
+* TEX2LYX
 
+- Fix import of table with linebreak in column specification.
 
-* TEX2LYX
+- Fix parsing of more complex column specification.
 
-- Update tex2lyx support for babel-german.
+- Error if TeX file has a preamble but no (accessible) \begin{document}
+  (bug 13297).
diff --git a/NEWS b/NEWS
index f2957d69e5..cf27cbd632 100644
--- a/NEWS
+++ b/NEWS
@@ -1,3 +1,16 @@
+What's new in version 2.5.2?
+----------------------------
+
+This release is somewhat special. Apart from usual bag of bugfixes we also
+include number of fixes to vulnerabilities dicovered in cooperation with AI
+tools.
+
+We strongly urge our users to upgrade from previous releases, especially
+if they routinely use/exchange .lyx documents with external parties.
+In previous versions of LyX, malformed .lyx documents can cause arbitrary
+execution of shell commands upon .lyx load or within export processing.
+
+
 What's new in version 2.5.1?
 ----------------------------
 
diff --git a/configure.ac b/configure.ac
index 18c0d1433c..972e8bd3a3 100644
--- a/configure.ac
+++ b/configure.ac
@@ -1,9 +1,9 @@
 dnl Process with autoconf to generate configure script   -*- sh -*-
 
-AC_INIT([LyX],[2.5.2~dev],[[email protected]],[lyx])
+AC_INIT([LyX],[2.5.2],[[email protected]],[lyx])
 AC_PRESERVE_HELP_ORDER
 # Use ISO format only. The frontend needs to parse this
-AC_SUBST(LYX_DATE, ["2026-04-12"])
+AC_SUBST(LYX_DATE, ["2026-07-28"])
 AC_PREREQ([2.65])
 AC_CONFIG_SRCDIR(src/main.cpp)
 AC_CONFIG_HEADERS([config.h])
-- 
lyx-cvs mailing list
[email protected]
https://lists.lyx.org/mailman/listinfo/lyx-cvs