commit 79b4dd151102fe5e82bc2e9d9f2504ae21c3f823
Author: Richard Kimberly Heck <[email protected]>
Date: Mon Aug 17 10:03:17 2026 -0400
2.5.2
---
announce/2_5_2.txt | 161 +++++++++++++++++++++++++++++++++++++++++++++
farm/cookbook/LyX/news.inc | 25 ++++++-
misc/rss/lyx_news_feed.xml | 4 +-
3 files changed, 187 insertions(+), 3 deletions(-)
diff --git a/announce/2_5_2.txt b/announce/2_5_2.txt
new file mode 100644
index 00000000..7d654ef1
--- /dev/null
+++ b/announce/2_5_2.txt
@@ -0,0 +1,161 @@
+Public release of LyX version 2.5.2
+===================================
+
+We are pleased to announce the release the LyX 2.5.2, the second maintenance
+release in the 2.5.x series.
+
+This release is somewhat special. Apart from usual bag of bugfixes we also
+include number of fixes to vulnerabilities dicovered in cooperation with AI
+tools.
+
+We strongly urge our users to upgrade from previous releases, especially
+if they routinely use/exchange .lyx documents with external parties.
+In previous versions of LyX, malformed .lyx documents can cause arbitrary
+execution of shell commands upon .lyx load or within export processing.
+
+As the capabilities of frontier AI models quickly develop this might not
+be the last such release and we suggest that users employ extreme caution
+when dealing with files from untrusted sources.
+
+This release fixes a number of mostly minor bugs in 2.5.1. One important fix
+solves the regression introduced in 2.5.1 which caused LyX not to store Qt
+session configuration (e.g. size and position of windows).
+
+If you think you may have found a bug in LyX 2.5.2, either email the
developers'
+mailing list (lyx-devel at lists.lyx.org), or open a bug report at
+ https://www.lyx.org/trac/wiki/BugTrackerHome
+Please specify if the behavior you are reporting is different from behavior in
+a previous LyX version. Please note that we have had to disable registration
+for new accounts due to spam. If you would like an account, email the LyX
+developers' list.
+
+If you have trouble using LyX or have a question, consult the documentation
+that comes with LyX (under Help) and the LyX wiki, which you will find at
+https://wiki.lyx.org/. You can also send email to the LyX users' list
+(lyx-users at lists.lyx.org).
+
+The LyX team.
+https://www.lyx.org
+
+
+What's new
+==========
+
+** Updates:
+***********
+
+* SECURITY HARDENING FIXES
+
+- Load-triggered arbitrary command execution vulnerabilities fixes:
+ - 00a: kpsewhich shell injection via filename
+ - 00b: lyx2lyx shell injection via filename
+ - 00c: graphics-extension name shell injection
+ - 00h: import-path filename shell injection into converters
+
+- Export/View triggered arbitrary command execution vulnerabilities fixes:
+ - 00d: bibtex command shell injection
+ - 00e: index command shell injection
+ - 00g: mangled filenames shell injection
+ - 00i: convert-pdf helper shell injection
+ - 00k: paperwidth/height injection causing arbitrary files rewrite
+
+- New consent authorization gate for unpatched external tools
+ - 00de: processing gate prompts before running a code-capable bib/index
tools
+ (biber/xindy/xindex) on an untrusted document,
+ The real fixes are upstream (biber 2.22, xindex 1.07, xindy from
up-to-date
+ TL tree), while the gate is LyX's interim guard.
+ For biber 2.22 the gate automatically relaxes to no-op.
+ - 00de-2: xindex version check relaxing the gate above.
+
+
+* DOCUMENT INPUT/OUTPUT
+
+- Issue an error on @ catcode mismatch by layout definitions (bug 13275)
+
+
+* MISCELLANEOUS
+
+- LyX now supports the Elsevier CAS classes.
+
+* TEX2LYX IMPROVEMENTS
+
+- Add support for \colorlet if the second arg is a known LaTeX or custom
+ color (bug 13310).
+
+
+* USER INTERFACE
+
+- Implement LFUN_REFERENCE_TO_PARAGRAPH for mathed (bug 13206).
+
+- It is now possible in the tabular creation dialog (Inset > Table) to
+ insert a multi-page table (optionally with caption) directly.
+
+- Simple search within selection now remembers the initial selection
+ beyond the first match (bug 13293).
+
+- Fix session information not being properly restored. This regression
+ introduced was introduced in 2.5.1 as a side effect of fixing macOS
+ crash on exit and new fix should fix both issues.
+
+
+* BUILD/INSTALLATION
+
+- Use inkscape as fallback png->eps converter if ImageMagick is not
+ available or IM policy does not allow for png->eps conversion.
+
+
+
+** Bug fixes:
+*************
+
+* DOCUMENT INPUT/OUTPUT
+
+- Fix problem with nesting of languages.
+
+- Fix closing of local CJK language with polyglossia (bug 13315).
+
+- Prevent duplicate theorem definitions (bug 13302).
+
+- Fix case where the colortbl package has been loaded unnecessarily
+ (bug 13306).
+
+- Fix order of theorem definitions for pandoc processing (bug 13307).
+
+- Fix support for import/export of ODT documents using pandoc.
+
+
+* USER INTERFACE
+
+- Fix crash when selecting inset (bug 13294).
+
+- Fix assertion when closing buffer with listings settings dialog open.
+
+- Consider longtable caption when adding new column (bug 13299).
+
+- Load externally referred buffers and initialize their labels.
+
+- Fix pasting of cross-references in math (bug 13290).
+
+- Fix pasting from LaTeX with keepEmpty environment in first paragraph
+ (bug 13295).
+
+- Fix casing of strings in English localization (bug 13304).
+
+- Fix background color drawing for non-center aligned tabular cells.
+
+- Fix on-screen representation of "pagewidth" length (bug 13309).
+
+- Fix sorting of colors in preferences.
+
+- Fix zoom-in/out functions so that the inverse (e.g. with the mouse wheel)
+ end up at the exact same value (bug 13327).
+
+
+* TEX2LYX
+
+- Fix import of table with linebreak in column specification.
+
+- Fix parsing of more complex column specification.
+
+- Error if TeX file has a preamble but no (accessible) \begin{document}
+ (bug 13297).
diff --git a/farm/cookbook/LyX/news.inc b/farm/cookbook/LyX/news.inc
index bff38d9c..a1f4e412 100644
--- a/farm/cookbook/LyX/news.inc
+++ b/farm/cookbook/LyX/news.inc
@@ -20,7 +20,30 @@
function news_data() {
-news_item("LyX 2.5.1 released.", "First maintenance release in 2.5.x Series",
"April 23, 2026",
+ news_item("LyX 2.5.2 released.", "Second maintenance release in 2.5.x
Series", "August 17, 2026",
+ "<p>We are very happy to announce the release of LyX 2.5.2. This
is the first maintenance release in the 2.5.x series. </p>
+
+ <p>This release is somewhat special. Apart from usual bag of
bugfixes we also
+ include number of fixes to vulnerabilities dicovered in
cooperation with AI
+ tools. </p>
+
+ <p>We strongly urge our users to upgrade from previous releases,
especially
+ if they routinely use/exchange .lyx documents with external
parties.
+ In previous versions of LyX, malformed .lyx documents can cause
arbitrary
+ execution of shell commands upon .lyx load or within export
processing. </p>
+
+ <p>This release also fixes a number of mostly minor bugs in 2.5.1.
One important fix solves the regression introduced in 2.5.1 which caused LyX
not to store Qt
+ session configuration (e.g. size and position of windows). </p>
+
+ <p>See
+ <a href=\"https://www.lyx.org/announce/2_5_2.txt\";>the
announcement</a>
+ for more information. </p>
+
+ <p>You can download the
+ <a
href=\"https://ftp.lip6.fr/pub/lyx/stable/2.5.x/lyx-2.5.2.tar.xz\";>sources in
tar.xz</a>. There are also some
+ <a href=\"https://ftp.lip6.fr/pub/lyx/bin/2.5.2/\";>binaries</a>
available. </p>");
+
+ news_item("LyX 2.5.1 released.", "First maintenance release in
2.5.x Series", "April 23, 2026",
"<p>We are very happy to announce the release of LyX 2.5.1. This
is the first maintenance release in the 2.5.x series. </p>
<p>This release fixes a number of mostly minor bugs in 2.5.0. One
important fix
diff --git a/misc/rss/lyx_news_feed.xml b/misc/rss/lyx_news_feed.xml
index 8e9fb302..348df2c0 100644
--- a/misc/rss/lyx_news_feed.xml
+++ b/misc/rss/lyx_news_feed.xml
@@ -1,7 +1,6 @@
<?xml version="1.0" encoding="iso-8859-1"?>
<rss version="2.0"><channel><title>LyX news
feed</title><link>https://www.lyx.org/News</link><description>The latest news
about LyX, a WYSIWYM document processor</description>
-<lastBuildDate>Thu, 23 Apr 2026 12:11:26
GMT</lastBuildDate><generator>PyRSS2Gen-1.0.0</generator><docs>http://blogs.law.harvard.edu/tech/rss</docs>
-<item><title>LyX 2.5.1
released.</title><link>https://www.lyx.org/News</link><description>First
maintenance release in 2.5.x Series</description><guid isPermaLink="false">LyX
news feed April 23, 2026</guid><pubDate>Thu, 23 Apr 2026 00:00:00
GMT</pubDate></item>
+<lastBuildDate>Mon, 17 Aug 2026 10:04:19
GMT</lastBuildDate><generator>PyRSS2Gen-1.0.0</generator><docs>http://blogs.law.harvard.edu/tech/rss</docs>
<item><title>LyX 2.5.0
released.</title><link>https://www.lyx.org/News</link><description>First
release in 2.5.x Series</description><guid isPermaLink="false">LyX news feed
February 21, 2026</guid><pubDate>Sat, 21 Feb 2026 00:00:00 GMT</pubDate></item>
<item><title>LyX 2.4.5
released.</title><link>https://www.lyx.org/News</link><description>Final
Maintenance Release in 2.4.x Series</description><guid isPermaLink="false">LyX
news feed February 24, 2026</guid><pubDate>Tue, 24 Feb 2026 00:00:00
GMT</pubDate></item>
<item><title>LyX 2.4.4
released.</title><link>https://www.lyx.org/News</link><description>Fourth
Maintenance Release in 2.4.x Series</description><guid isPermaLink="false">LyX
news feed June 21, 2025</guid><pubDate>Sat, 21 Jun 2025 00:00:00
GMT</pubDate></item>
@@ -9,4 +8,5 @@
<item><title>LyX 2.4.2
released.</title><link>https://www.lyx.org/News</link><description>Second
Maintenance Release in 2.4.x Series</description><guid isPermaLink="false">LyX
news feed October 3, 2024</guid><pubDate>Thu, 03 Oct 2024 00:00:00
GMT</pubDate></item>
<item><title>LyX 2.4.1
released.</title><link>https://www.lyx.org/News</link><description>First
Maintenance Release in 2.4.x Series</description><guid isPermaLink="false">LyX
news feed July 5, 2024</guid><pubDate>Fri, 05 Jul 2024 00:00:00
GMT</pubDate></item>
<item><title>LyX 2.4.0
released.</title><link>https://www.lyx.org/News</link><description>First
Release in 2.4.x Series</description><guid isPermaLink="false">LyX news feed
May 31, 2024</guid><pubDate>Fri, 31 May 2024 00:00:00 GMT</pubDate></item>
+<item><title>LyX 2.3.8
released.</title><link>https://www.lyx.org/News</link><description>Eighth
Maintenance Release in 2.3.x Series</description><guid isPermaLink="false">LyX
news feed May 17, 2024</guid><pubDate>Fri, 17 May 2024 00:00:00
GMT</pubDate></item>
</channel></rss>
--
lyx-cvs mailing list
[email protected]
https://lists.lyx.org/mailman/listinfo/lyx-cvs
