epel

#212 'novnc' major version/breaking update in EPEL7
Closed: Fixed by tdawson. Opened by jonathanspw.

Closed: Fixed
Reopen Issue

I recently took the novnc package which was orphaned and I'm trying to get it cleaned up a bit. There is currently an open CVE for version 0.5.1 in EPEL7: https://bugzilla.redhat.com/show_bug.cgi?id=1765662

The vulnerability was not fixed until 0.6.2 which already had breaking changes from 0.5.1. https://github.com/novnc/noVNC/releases/tag/v0.6.2

There are no known backports of the fixes to 0.5.x and since the fixes were during a very active time of development with many changes it would be impractical to create and maintain such backports.

The releases after 0.6.2 do not cite breaking changes to libraries so I think it makes sense to update to the currently supported upstream release of 1.3.0.

The total breaking changes cited in changelogs between 0.5.1 and 1.3.0 are as follows:
- 0.6.1: Warning: this release removes support for legacy browsers, namely IE9 and below. IE10 may receive "best-effort" support. IE 11+, Edge, Firefox 31+, and Chrome 44+ continue to be supported
- 0.6.1: Warning: this release includes a number of potentially breaking changes to internal libraries
- 0.7.0: renamed vnc_auto.html to vnc_simple.html. We can maintain a symlink to not break this functionality (only for EL7) until its EOL in 2024. https://github.com/novnc/noVNC/issues/695#issuecomment-300999837

RedHat's solution to the issue in their OpenStack product was to rebase to 1.1 (which at the time they rebased was the latest stable release).

https://access.redhat.com/errata/RHSA-2020:0754
https://bugzilla.redhat.com/show_bug.cgi?id=1484711

Metadata Update from @tdawson:
- Issue tagged with: meeting

+1

Metadata Update from @gotmax23:
- Issue untagged with: meeting

Metadata Update from @gotmax23:
- Issue tagged with: meeting

+1 from Smoogen

+1

This was announced a week ago on the epel-devel list with no responses. That covers steps 1 and 2 of the incompatible upgrade process. Steps 3 was covered by discussing it at today's EPEL Steering Committee meeting. In addition to the +1s in this ticket so far, @ngompa also gave a +1 during the meeting. You are cleared to build the update and proceed with the rest of the steps.

Thank you for following the proceedures. This has been approved by the committee and you can now build and release the incompatible update.

Metadata Update from @tdawson:
- Issue close_status updated to: Fixed
- Issue status updated to: Closed (was: Open)

This issue has been migrated to Fedora Forge:
https://forge.fedoraproject.org/epel/steering/issues/212

Please continue any further discussion there.
Metadata
None

meeting

None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.