Repository navigation
Backport eight official PCRE2 fixes for Server 550 - #355
Merged
Merged
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Ubuntu 26.04 still ships PCRE2 10.46 without eight security fixes that upstream has already published. Rebuild the two existing runtime packages from the exact Ubuntu source with the official supported 10.46 backport series, retaining packaging, ABI, JIT and POSIX behavior.
Pin every source and patch by SHA-256; require the original native suites, package/ELF integrity and actual grep, Git, MariaDB, libselinux and POSIX linkage. Keep the six-stage build and existing layer limit, preserve raw scanner evidence and bind fixed dispositions to the exact rebuilt package versions. Other pending findings remain tracked. Prepare numeric Server v1.6.550; installation examples retain the published v1.6.549 until a new immutable release passes its gates.
Validation: 13 builder and 5 verifier contract tests; 15 Linux offline-installer tests; 47 assembly-contract tests and the owning assembly gate; original pcre2_jit_test / RunTest / RunGrepTest PASS in isolated Ubuntu26; exact Server549-derived child image passes all five consumer linkages and both-locale grep/Git controls. Independent review found no actionable issue. Final-image publication/startup/restart checks are still required. No production deployment or runtime patch.