Re: Fixing security vulnerabilities before new releases

> From: Stefan Monnier <[email protected]>
> Cc: Eshel Yaron <[email protected]>,  [email protected],
>   [email protected],  [email protected]
> Date: Sat, 01 Aug 2026 12:29:09 -0400
> 
> >> > so we could introduce an `intern--without-shorthands` and replace the
> >> > few `intern` calls we see as risky.
> >> SGTM.  Should I prepare a patch, or leave it you?
> > I don't think we can install such changes on the emacs-31 branch at
> > this time, sorry.
> 
> Given the severity of the security hole, what kind of change would you
> consider acceptable?

I'm okay with the changes proposed by Eshel, but not with introduction
of intern--without-shorthands.

> E.g. is Eshel's `vc-hooks.el` patch acceptable?

Yes.

> BTW, w.r.t mitigation, maybe we could install a patch like the
> one below?

Again, IMO to late for such changes on the emacs-31 branch, unless we
want to delay the release of Emacs 31.1 for another month or two.

(And I'm not sure I agree that a shorthand which shortens the symbol's
name is necessarily safe.)