package/python-pygments: security bump to version 2.7.4

Fixes the following security issues:

- CVE-2021-20270: An infinite loop in SMLLexer in Pygments versions 1.5 to
  2.7.3 may lead to denial of service when performing syntax highlighting of
  a Standard ML (SML) source file, as demonstrated by input that only
  contains the "exception" keyword

- CVE-2021-27291: In pygments 1.1+, fixed in 2.7.4, the lexers used to parse
  programming languages rely heavily on regular expressions.  Some of the
  regular expressions have exponential or cubic worst-case complexity and
  are vulnerable to ReDoS.  By crafting malicious input, an attacker can
  cause a denial of service

Python 2.x support was dropped in pygments 2.6, so adjust (reverse)
dependencies:

Version 2.6
-----------
(released March 8, 2020)

- Running Pygments on Python 2.x is no longer supported.
  (The Python 2 lexer still exists.)

Adjust the license hash for a change of copyright years:
a590ac5ea7

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
This commit is contained in:
Peter Korsgaard
2021-04-04 20:59:07 +02:00
committed by Thomas Petazzoni
parent 94fa503d7b
commit 03c2a81231
4 changed files with 8 additions and 7 deletions

View File

@@ -1,5 +1,5 @@
# md5, sha256 from https://pypi.org/pypi/pygments/json
md5 5ecc3fbb2a783e917b369271fc0e6cd1 Pygments-2.4.2.tar.gz
sha256 881c4c157e45f30af185c1ffe8d549d48ac9127433f2c380c24b84572ad66297 Pygments-2.4.2.tar.gz
md5 390a49fa0eb5486a795b2b54b9a7b666 Pygments-2.7.4.tar.gz
sha256 df49d09b498e83c1a73128295860250b0b7edd4c723a32e9bc0d295c7c2ec337 Pygments-2.7.4.tar.gz
# Locally computed sha256 checksums
sha256 45b88d3449c37806594758bf3c484d9d98b12b1ecc163f65431fe07fea6025f0 LICENSE
sha256 c012cf17a2ba79142977c8cc5bb1497a675401bf79c2c9b95a7604e2ddfde8b8 LICENSE