commit de6957f648f01efad586a56713d45ff0e49f1c43
Author: Richard Kimberly Heck <[email protected]>
Date: Tue Jul 28 11:03:46 2026 -0400
Prepare for 2.5.2
---
ANNOUNCE | 137 ++++++++++++++++++++++++++++++++++++++---------------------
NEWS | 13 ++++++
configure.ac | 4 +-
3 files changed, 104 insertions(+), 50 deletions(-)
diff --git a/ANNOUNCE b/ANNOUNCE
index 43ddcc8c36..7d654ef151 100644
--- a/ANNOUNCE
+++ b/ANNOUNCE
@@ -1,21 +1,27 @@
-Public release of LyX version 2.5.1
+Public release of LyX version 2.5.2
===================================
-We are proud to announce the release the LyX 2.5.1, the first maintenance
+We are pleased to announce the release the LyX 2.5.2, the second maintenance
release in the 2.5.x series.
-This release fixes a number of mostly minor bugs in 2.5.0. One important fix
-concerns crashes when exiting LyX on OSX, specifically when documents are still
-open. We have also fixed a handful of bugs with the new input method support.
-If you should encounter any more, please do let us know.
+This release is somewhat special. Apart from usual bag of bugfixes we also
+include number of fixes to vulnerabilities dicovered in cooperation with AI
+tools.
-If a file from an earlier version of LyX is opened *and saved* with any version
-of 2.5.x, then the original file will automatically be backed up. The backup
-file will be found in the backup directory, if one is set under
-Tools> Preferences> Paths
-or else in the same folder as the original file, if no backup directory is set.
+We strongly urge our users to upgrade from previous releases, especially
+if they routinely use/exchange .lyx documents with external parties.
+In previous versions of LyX, malformed .lyx documents can cause arbitrary
+execution of shell commands upon .lyx load or within export processing.
-If you think you may have found a bug in LyX 2.5.1, either email the
developers'
+As the capabilities of frontier AI models quickly develop this might not
+be the last such release and we suggest that users employ extreme caution
+when dealing with files from untrusted sources.
+
+This release fixes a number of mostly minor bugs in 2.5.1. One important fix
+solves the regression introduced in 2.5.1 which caused LyX not to store Qt
+session configuration (e.g. size and position of windows).
+
+If you think you may have found a bug in LyX 2.5.2, either email the
developers'
mailing list (lyx-devel at lists.lyx.org), or open a bug report at
https://www.lyx.org/trac/wiki/BugTrackerHome
Please specify if the behavior you are reporting is different from behavior in
@@ -31,36 +37,71 @@ https://wiki.lyx.org/. You can also send email to the LyX
users' list
The LyX team.
https://www.lyx.org
+
What's new
==========
** Updates:
***********
+* SECURITY HARDENING FIXES
+
+- Load-triggered arbitrary command execution vulnerabilities fixes:
+ - 00a: kpsewhich shell injection via filename
+ - 00b: lyx2lyx shell injection via filename
+ - 00c: graphics-extension name shell injection
+ - 00h: import-path filename shell injection into converters
+
+- Export/View triggered arbitrary command execution vulnerabilities fixes:
+ - 00d: bibtex command shell injection
+ - 00e: index command shell injection
+ - 00g: mangled filenames shell injection
+ - 00i: convert-pdf helper shell injection
+ - 00k: paperwidth/height injection causing arbitrary files rewrite
+
+- New consent authorization gate for unpatched external tools
+ - 00de: processing gate prompts before running a code-capable bib/index
tools
+ (biber/xindy/xindex) on an untrusted document,
+ The real fixes are upstream (biber 2.22, xindex 1.07, xindy from
up-to-date
+ TL tree), while the gate is LyX's interim guard.
+ For biber 2.22 the gate automatically relaxes to no-op.
+ - 00de-2: xindex version check relaxing the gate above.
+
+
* DOCUMENT INPUT/OUTPUT
-- Support the Sioyek PDF viewer.
+- Issue an error on @ catcode mismatch by layout definitions (bug 13275)
-* USER INTERFACE
+* MISCELLANEOUS
+
+- LyX now supports the Elsevier CAS classes.
+
+* TEX2LYX IMPROVEMENTS
+
+- Add support for \colorlet if the second arg is a known LaTeX or custom
+ color (bug 13310).
-- Enable dark/light mode preference setting on Linux.
- This is supported at least for QT_QPA_PLATFORMTHEME=gtk3 (bug 12224).
+* USER INTERFACE
-* DOCUMENTATION AND LOCALIZATION
+- Implement LFUN_REFERENCE_TO_PARAGRAPH for mathed (bug 13206).
-- Update the KOMA-Letter (v. 2) template.
+- It is now possible in the tabular creation dialog (Inset > Table) to
+ insert a multi-page table (optionally with caption) directly.
-- Add a German KOMA-Letter (v. 2) template.
+- Simple search within selection now remembers the initial selection
+ beyond the first match (bug 13293).
-- Update Brazilian Portuguese, Czech, Dutch, German, Italian, Japanese, and
- Slovak translations.
+- Fix session information not being properly restored. This regression
+ introduced was introduced in 2.5.1 as a side effect of fixing macOS
+ crash on exit and new fix should fix both issues.
* BUILD/INSTALLATION
-- Accept macos SDKs with version 20 and higher to build bundle package.
+- Use inkscape as fallback png->eps converter if ImageMagick is not
+ available or IM policy does not allow for png->eps conversion.
@@ -69,52 +110,52 @@ What's new
* DOCUMENT INPUT/OUTPUT
-- Fix an assertion caused by the new Input Method implementation in relation to
- the change of work area.
+- Fix problem with nesting of languages.
+
+- Fix closing of local CJK language with polyglossia (bug 13315).
-- Properly resolve font in insets that do not inherit font (bug 13278).
+- Prevent duplicate theorem definitions (bug 13302).
-- Fix switch of text direction with verbatim content (bug 6373).
+- Fix case where the colortbl package has been loaded unnecessarily
+ (bug 13306).
-- Fix several cases where language begin/end commands have not been
- properly nested when "Set document language explicitly" or
- "Unset document language explicitly" have been selected in preferences.
+- Fix order of theorem definitions for pandoc processing (bug 13307).
-- Fix old docbook layouts.
+- Fix support for import/export of ODT documents using pandoc.
* USER INTERFACE
-- Fix crash in mathed when using cursor right to end the input of
- macro names like \alpha.
+- Fix crash when selecting inset (bug 13294).
-- Fix crash when quitting LyX on recent macOS versions.
+- Fix assertion when closing buffer with listings settings dialog open.
-- Fix cross-references dialog in mathed (bug 13285).
+- Consider longtable caption when adding new column (bug 13299).
-- Fix pasting of partial math grids (bug 13277).
+- Load externally referred buffers and initialize their labels.
-- Fix logic of auto-insertion to argument insets (part of 12364).
+- Fix pasting of cross-references in math (bug 13290).
-- Automatically insert overlay argument of beamer layouts (part of 12364).
+- Fix pasting from LaTeX with keepEmpty environment in first paragraph
+ (bug 13295).
-- Fix empty paragraph check in pasting (bug 13281).
+- Fix casing of strings in English localization (bug 13304).
-- Do not allow to split InsetArgument which does not make sense.
+- Fix background color drawing for non-center aligned tabular cells.
-- Fix initial value of custom color dialog.
+- Fix on-screen representation of "pagewidth" length (bug 13309).
-- Build InsetInfo info also when inset is hidden in collapsible (bug 13280).
+- Fix sorting of colors in preferences.
-- Fix computer algebra system bug: converting the displayed math
- into eqnarray* environment (bug 13247).
+- Fix zoom-in/out functions so that the inverse (e.g. with the mouse wheel)
+ end up at the exact same value (bug 13327).
-- Fix PDF->PNG conversion problem on macOS. Now gs takes priority over sips
- on that os (bug 12632).
-- Reintroduce a proper version of a broken optimization that was removed for
2.5.0.
+* TEX2LYX
+- Fix import of table with linebreak in column specification.
-* TEX2LYX
+- Fix parsing of more complex column specification.
-- Update tex2lyx support for babel-german.
+- Error if TeX file has a preamble but no (accessible) \begin{document}
+ (bug 13297).
diff --git a/NEWS b/NEWS
index f2957d69e5..cf27cbd632 100644
--- a/NEWS
+++ b/NEWS
@@ -1,3 +1,16 @@
+What's new in version 2.5.2?
+----------------------------
+
+This release is somewhat special. Apart from usual bag of bugfixes we also
+include number of fixes to vulnerabilities dicovered in cooperation with AI
+tools.
+
+We strongly urge our users to upgrade from previous releases, especially
+if they routinely use/exchange .lyx documents with external parties.
+In previous versions of LyX, malformed .lyx documents can cause arbitrary
+execution of shell commands upon .lyx load or within export processing.
+
+
What's new in version 2.5.1?
----------------------------
diff --git a/configure.ac b/configure.ac
index 18c0d1433c..972e8bd3a3 100644
--- a/configure.ac
+++ b/configure.ac
@@ -1,9 +1,9 @@
dnl Process with autoconf to generate configure script -*- sh -*-
-AC_INIT([LyX],[2.5.2~dev],[[email protected]],[lyx])
+AC_INIT([LyX],[2.5.2],[[email protected]],[lyx])
AC_PRESERVE_HELP_ORDER
# Use ISO format only. The frontend needs to parse this
-AC_SUBST(LYX_DATE, ["2026-04-12"])
+AC_SUBST(LYX_DATE, ["2026-07-28"])
AC_PREREQ([2.65])
AC_CONFIG_SRCDIR(src/main.cpp)
AC_CONFIG_HEADERS([config.h])
--
lyx-cvs mailing list
[email protected]
https://lists.lyx.org/mailman/listinfo/lyx-cvs
