commit 58551a953b98371da7e5dddbb7e250a276b30ea5 · pyrox.dev/nixpkgs

+32 -1
pkgs/development/python-modules/django-ckeditor/default.nix
···

       50
       50
        
         pythonImportsCheck = [ "ckeditor" ];

     

       51
       51
        
       

     

       52
       52
        
         meta = with lib; {

     

       53
       53
       -
           description = " Django admin CKEditor integration";

     

       53
       53
       +
           description = "Django admin CKEditor integration";

     

       54
       54
        
           homepage = "https://github.com/django-ckeditor/django-ckeditor";

     

       55
       55
        
           changelog = "https://github.com/django-ckeditor/django-ckeditor/blob/${version}/CHANGELOG.rst";

     

       56
       56
        
           license = licenses.bsd3;

     

       57
       57
        
           maintainers = with maintainers; [ onny ];

     

       58
       58
       +
           knownVulnerabilities = [

     

       59
       59
       +
             ''

     

       60
       60
       +
               django-ckeditor bundles CKEditor 4.22.1 which isn’t supported anmyore and

     

       61
       61
       +
               which does have unfixed security issues

     

       62
       62
       +
       

     

       63
       63
       +
               Existing users of django-ckeditor should consider switching to a

     

       64
       64
       +
               different editor such as CKEditor 5 (django-ckeditor-5), after verifying

     

       65
       65
       +
               that its GPL licensing terms are acceptable, or ProseMirror

     

       66
       66
       +
               (django-prose-mirror by the author of django-ckeditor). Support of the

     

       67
       67
       +
               CKEditor 4 package is provided by its upstream developers as a

     

       68
       68
       +
               non-free/commercial LTS package until December 2028.

     

       69
       69
       +
       

     

       70
       70
       +
               Note that while there are publically known vulnerabilities for the

     

       71
       71
       +
               CKEditor 4 series, the exploitability of these issues depends on how

     

       72
       72
       +
               CKEditor is used by the given Django application.

     

       73
       73
       +
       

     

       74
       74
       +
               Further information:

     

       75
       75
       +
       

     

       76
       76
       +
               * List of vulnerabilites fixed in CKEditor 4.24.0-lts:

     

       77
       77
       +
       

     

       78
       78
       +
                 * GHSA-fq6h-4g8v-qqvm

     

       79
       79
       +
                 * GHSA-fq6h-4g8v-qqvm

     

       80
       80
       +
                 * GHSA-mw2c-vx6j-mg76

     

       81
       81
       +
       

     

       82
       82
       +
               * The django-ckeditor deprecation notice:

     

       83
       83
       +
                 <https://406.ch/writing/django-ckeditor/>

     

       84
       84
       +
       

     

       85
       85
       +
               * The non-free/commerical CKEditor 4 LTS package:

     

       86
       86
       +
                 <https://ckeditor.com/ckeditor-4-support/>

     

       87
       87
       +
             ''

     

       88
       88
       +
           ];

     

       58
       89
        
         };

     

       59
       90
        
       }