[Web/master] 2.5.2
Richard Kimberly Heck <[email protected]>
| Newsgroups | gmane.editors.lyx.cvs |
|---|---|
| Message-ID | <[email protected]> |
commit 79b4dd151102fe5e82bc2e9d9f2504ae21c3f823 Author: Richard Kimberly Heck <[email protected]> Date: Mon Aug 17 10:03:17 2026 -0400 2.5.2 --- announce/2_5_2.txt | 161 +++++++++++++++++++++++++++++++++++++++++++++ farm/cookbook/LyX/news.inc | 25 ++++++- misc/rss/lyx_news_feed.xml | 4 +- 3 files changed, 187 insertions(+), 3 deletions(-) diff --git a/announce/2_5_2.txt b/announce/2_5_2.txt new file mode 100644 index 00000000..7d654ef1 --- /dev/null +++ b/announce/2_5_2.txt @@ -0,0 +1,161 @@ +Public release of LyX version 2.5.2 +=================================== + +We are pleased to announce the release the LyX 2.5.2, the second maintenance +release in the 2.5.x series. + +This release is somewhat special. Apart from usual bag of bugfixes we also +include number of fixes to vulnerabilities dicovered in cooperation with AI +tools. + +We strongly urge our users to upgrade from previous releases, especially +if they routinely use/exchange .lyx documents with external parties. +In previous versions of LyX, malformed .lyx documents can cause arbitrary +execution of shell commands upon .lyx load or within export processing. + +As the capabilities of frontier AI models quickly develop this might not +be the last such release and we suggest that users employ extreme caution +when dealing with files from untrusted sources. + +This release fixes a number of mostly minor bugs in 2.5.1. One important fix +solves the regression introduced in 2.5.1 which caused LyX not to store Qt +session configuration (e.g. size and position of windows). + +If you think you may have found a bug in LyX 2.5.2, either email the developers' +mailing list (lyx-devel at lists.lyx.org), or open a bug report at + https://www.lyx.org/trac/wiki/BugTrackerHome +Please specify if the behavior you are reporting is different from behavior in +a previous LyX version. Please note that we have had to disable registration +for new accounts due to spam. If you would like an account, email the LyX +developers' list. + +If you have trouble using LyX or have a question, consult the documentation +that comes with LyX (under Help) and the LyX wiki, which you will find at +https://wiki.lyx.org/. You can also send email to the LyX users' list +(lyx-users at lists.lyx.org). + +The LyX team. +https://www.lyx.org + + +What's new +========== + +** Updates: +*********** + +* SECURITY HARDENING FIXES + +- Load-triggered arbitrary command execution vulnerabilities fixes: + - 00a: kpsewhich shell injection via filename + - 00b: lyx2lyx shell injection via filename + - 00c: graphics-extension name shell injection + - 00h: import-path filename shell injection into converters + +- Export/View triggered arbitrary command execution vulnerabilities fixes: + - 00d: bibtex command shell injection + - 00e: index command shell injection + - 00g: mangled filenames shell injection + - 00i: convert-pdf helper shell injection + - 00k: paperwidth/height injection causing arbitrary files rewrite + +- New consent authorization gate for unpatched external tools + - 00de: processing gate prompts before running a code-capable bib/index tools + (biber/xindy/xindex) on an untrusted document, + The real fixes are upstream (biber 2.22, xindex 1.07, xindy from up-to-date + TL tree), while the gate is LyX's interim guard. + For biber 2.22 the gate automatically relaxes to no-op. + - 00de-2: xindex version check relaxing the gate above. + + +* DOCUMENT INPUT/OUTPUT + +- Issue an error on @ catcode mismatch by layout definitions (bug 13275) + + +* MISCELLANEOUS + +- LyX now supports the Elsevier CAS classes. + +* TEX2LYX IMPROVEMENTS + +- Add support for \colorlet if the second arg is a known LaTeX or custom + color (bug 13310). + + +* USER INTERFACE + +- Implement LFUN_REFERENCE_TO_PARAGRAPH for mathed (bug 13206). + +- It is now possible in the tabular creation dialog (Inset > Table) to + insert a multi-page table (optionally with caption) directly. + +- Simple search within selection now remembers the initial selection + beyond the first match (bug 13293). + +- Fix session information not being properly restored. This regression + introduced was introduced in 2.5.1 as a side effect of fixing macOS + crash on exit and new fix should fix both issues. + + +* BUILD/INSTALLATION + +- Use inkscape as fallback png->eps converter if ImageMagick is not + available or IM policy does not allow for png->eps conversion. + + + +** Bug fixes: +************* + +* DOCUMENT INPUT/OUTPUT + +- Fix problem with nesting of languages. + +- Fix closing of local CJK language with polyglossia (bug 13315). + +- Prevent duplicate theorem definitions (bug 13302). + +- Fix case where the colortbl package has been loaded unnecessarily + (bug 13306). + +- Fix order of theorem definitions for pandoc processing (bug 13307). + +- Fix support for import/export of ODT documents using pandoc. + + +* USER INTERFACE + +- Fix crash when selecting inset (bug 13294). + +- Fix assertion when closing buffer with listings settings dialog open. + +- Consider longtable caption when adding new column (bug 13299). + +- Load externally referred buffers and initialize their labels. + +- Fix pasting of cross-references in math (bug 13290). + +- Fix pasting from LaTeX with keepEmpty environment in first paragraph + (bug 13295). + +- Fix casing of strings in English localization (bug 13304). + +- Fix background color drawing for non-center aligned tabular cells. + +- Fix on-screen representation of "pagewidth" length (bug 13309). + +- Fix sorting of colors in preferences. + +- Fix zoom-in/out functions so that the inverse (e.g. with the mouse wheel) + end up at the exact same value (bug 13327). + + +* TEX2LYX + +- Fix import of table with linebreak in column specification. + +- Fix parsing of more complex column specification. + +- Error if TeX file has a preamble but no (accessible) \begin{document} + (bug 13297). diff --git a/farm/cookbook/LyX/news.inc b/farm/cookbook/LyX/news.inc index bff38d9c..a1f4e412 100644 --- a/farm/cookbook/LyX/news.inc +++ b/farm/cookbook/LyX/news.inc @@ -20,7 +20,30 @@ function news_data() { -news_item("LyX 2.5.1 released.", "First maintenance release in 2.5.x Series", "April 23, 2026", + news_item("LyX 2.5.2 released.", "Second maintenance release in 2.5.x Series", "August 17, 2026", + "<p>We are very happy to announce the release of LyX 2.5.2. This is the first maintenance release in the 2.5.x series. </p> + + <p>This release is somewhat special. Apart from usual bag of bugfixes we also + include number of fixes to vulnerabilities dicovered in cooperation with AI + tools. </p> + + <p>We strongly urge our users to upgrade from previous releases, especially + if they routinely use/exchange .lyx documents with external parties. + In previous versions of LyX, malformed .lyx documents can cause arbitrary + execution of shell commands upon .lyx load or within export processing. </p> + + <p>This release also fixes a number of mostly minor bugs in 2.5.1. One important fix solves the regression introduced in 2.5.1 which caused LyX not to store Qt + session configuration (e.g. size and position of windows). </p> + + <p>See + <a href=\"https://www.lyx.org/announce/2_5_2.txt\">the announcement</a> + for more information. </p> + + <p>You can download the + <a href=\"https://ftp.lip6.fr/pub/lyx/stable/2.5.x/lyx-2.5.2.tar.xz\">sources in tar.xz</a>. There are also some + <a href=\"https://ftp.lip6.fr/pub/lyx/bin/2.5.2/\">binaries</a> available. </p>"); + + news_item("LyX 2.5.1 released.", "First maintenance release in 2.5.x Series", "April 23, 2026", "<p>We are very happy to announce the release of LyX 2.5.1. This is the first maintenance release in the 2.5.x series. </p> <p>This release fixes a number of mostly minor bugs in 2.5.0. One important fix diff --git a/misc/rss/lyx_news_feed.xml b/misc/rss/lyx_news_feed.xml index 8e9fb302..348df2c0 100644 --- a/misc/rss/lyx_news_feed.xml +++ b/misc/rss/lyx_news_feed.xml @@ -1,7 +1,6 @@ <?xml version="1.0" encoding="iso-8859-1"?> <rss version="2.0"><channel><title>LyX news feed</title><link>https://www.lyx.org/News</link><description>The latest news about LyX, a WYSIWYM document processor</description> -<lastBuildDate>Thu, 23 Apr 2026 12:11:26 GMT</lastBuildDate><generator>PyRSS2Gen-1.0.0</generator><docs>http://blogs.law.harvard.edu/tech/rss</docs> -<item><title>LyX 2.5.1 released.</title><link>https://www.lyx.org/News</link><description>First maintenance release in 2.5.x Series</description><guid isPermaLink="false">LyX news feed April 23, 2026</guid><pubDate>Thu, 23 Apr 2026 00:00:00 GMT</pubDate></item> +<lastBuildDate>Mon, 17 Aug 2026 10:04:19 GMT</lastBuildDate><generator>PyRSS2Gen-1.0.0</generator><docs>http://blogs.law.harvard.edu/tech/rss</docs> <item><title>LyX 2.5.0 released.</title><link>https://www.lyx.org/News</link><description>First release in 2.5.x Series</description><guid isPermaLink="false">LyX news feed February 21, 2026</guid><pubDate>Sat, 21 Feb 2026 00:00:00 GMT</pubDate></item> <item><title>LyX 2.4.5 released.</title><link>https://www.lyx.org/News</link><description>Final Maintenance Release in 2.4.x Series</description><guid isPermaLink="false">LyX news feed February 24, 2026</guid><pubDate>Tue, 24 Feb 2026 00:00:00 GMT</pubDate></item> <item><title>LyX 2.4.4 released.</title><link>https://www.lyx.org/News</link><description>Fourth Maintenance Release in 2.4.x Series</description><guid isPermaLink="false">LyX news feed June 21, 2025</guid><pubDate>Sat, 21 Jun 2025 00:00:00 GMT</pubDate></item> @@ -9,4 +8,5 @@ <item><title>LyX 2.4.2 released.</title><link>https://www.lyx.org/News</link><description>Second Maintenance Release in 2.4.x Series</description><guid isPermaLink="false">LyX news feed October 3, 2024</guid><pubDate>Thu, 03 Oct 2024 00:00:00 GMT</pubDate></item> <item><title>LyX 2.4.1 released.</title><link>https://www.lyx.org/News</link><description>First Maintenance Release in 2.4.x Series</description><guid isPermaLink="false">LyX news feed July 5, 2024</guid><pubDate>Fri, 05 Jul 2024 00:00:00 GMT</pubDate></item> <item><title>LyX 2.4.0 released.</title><link>https://www.lyx.org/News</link><description>First Release in 2.4.x Series</description><guid isPermaLink="false">LyX news feed May 31, 2024</guid><pubDate>Fri, 31 May 2024 00:00:00 GMT</pubDate></item> +<item><title>LyX 2.3.8 released.</title><link>https://www.lyx.org/News</link><description>Eighth Maintenance Release in 2.3.x Series</description><guid isPermaLink="false">LyX news feed May 17, 2024</guid><pubDate>Fri, 17 May 2024 00:00:00 GMT</pubDate></item> </channel></rss> -- lyx-cvs mailing list [email protected] https://lists.lyx.org/mailman/listinfo/lyx-cvs