Maintainer Mode
Sign in with GitHub
Work in progress. Maintainer Mode changes every day: pages, numbers and links can change or break. Tell us what is wrong or missing.

grav

grav 1.7.53.5 · pkgs/by-name/gr/grav/package.nix
Sign in to subscribe
Health
Risk
risk 29 medium
  • +15 marked insecure: meta.knownVulnerabilities
  • +12 1.7.53.5 is behind upstream 2.2.10, a major release
  • +2 no meta.mainProgram, no versionCheckHook
Version
1.7.53.5 upstream 2.2.10
Channels
master 1.7.53.5 · nixos-unstable 1.7.53.5 · nixos-26.05 1.7.53.5 no channel is behind master
Hydra
succeeded 7w ago
Advisories
none open
Packaging
meta.knownVulnerabilities no meta.mainProgram no versionCheckHook
Packagewhat each field means
Description
Fast, simple, and flexible, file-based web platform
Homepage
https://getgrav.com
License
MIT
Platforms
not set
Source provenance
not set: built from source
Outputs
out
Status
insecure
  • Grav 1 contains a number of known vulnerabilities, please upgrade to Grav 2. This can be done by following the migration instructions[1]. Note, unfortunately using the automatic migration plugin does not work since it cannot write to the Nix store. If you use the NixOS module, then add service.grav.package = pkgs.grav_2; to your configuration to use Grav 2 after you have migrated your site. [1]: https://learn.getgrav.org/20/migration/manual-migration.
Position
pkgs/by-name/gr/grav/package.nix:37
Maintainers
rycee
Version bumps 0all open bumps
None open. Upstream has 2.2.10: how to update a package.
Pull requests 0
None open.
Closed or merged in the synced window 8
[Backport release-26.05] grav: 1.7.53.3 -> 1.7.53.5
#571821 by nixpkgs-ci · merged 8d ago
grav: 1.7.53.3 -> 1.7.53.5
#571816 by rycee · merged 8d ago
[Backport release-26.05] grav: 1.7.53.2 -> 1.7.53.3
#561529 by nixpkgs-ci · merged 5w ago
grav: 1.7.53.2 -> 1.7.53.3
#561352 by rycee · merged 5w ago
grav: 1.7.53.2 -> 2.0.24 draft
#553849 by r-ryantm · closed 8d ago
Deprecate grav package and introduce grav_2
#553677 by rycee · merged 5w ago
grav: 1.7.53.2 -> 2.0.17
#535398 by r-ryantm · closed 2mo ago
grav: 1.7.50.3 -> 1.7.49.4
#472880 by DieracDelta · closed 2mo ago
Issues 0
None open.
Closed or merged in the synced window 10
Grav: Low-privileged API users can create super-admin accounts via blueprint-upload 1.severity: security
#519713 by nixpkgs-security-tracker · closed 5w ago · 0 comments
Grav: Unauthenticated Path Traversal & Arbitrary File Write in FormFlash component. 1.severity: security
#519392 by nixpkgs-security-tracker · closed 5w ago · 0 comments
Grav: Stored XSS via Markdown media attribute() action in Grav CMS 1.severity: security
#519389 by nixpkgs-security-tracker · closed 5w ago · 0 comments
Grav: Administrative Account Disruption and Privilege De-escalation via User Overwrite Logic 1.severity: security
#519381 by nixpkgs-security-tracker · closed 5w ago · 0 comments
Grav: Remote Code Execution (RCE) via Malicious Plugin ZIP Upload in Direct Install Feature 1.severity: security
#519380 by nixpkgs-security-tracker · closed 5w ago · 0 comments
Grav: Twig sandbox allows editor-role users to exfiltrate all plugin secrets via Config::toArray() 1.severity: security
#519377 by nixpkgs-security-tracker · closed 5w ago · 0 comments
Grav: Privilege Escalation via Missing Server-Side Validation of groups/access 1.severity: security
#519370 by nixpkgs-security-tracker · closed 5w ago · 0 comments
Grav: Stored XSS via Tag Injection 1.severity: security
#519369 by nixpkgs-security-tracker · closed 5w ago · 0 comments
Grav: Sensitive Information Disclosure via Accounts Service Bypass 1.severity: security
#519365 by nixpkgs-security-tracker · closed 5w ago · 0 comments
Grav: Publisher-Level Stored XSS via Unquoted Event Attributes 1.severity: security
#519357 by nixpkgs-security-tracker · closed 5w ago · 0 comments