Skip to content

Update lief to 1.0.0 - #416

Closed
gominimal-pkgmgr-mgr[bot] wants to merge 1 commit into
mainfrom
update-lief-1.0.0
Closed

Update lief to 1.0.0#416
gominimal-pkgmgr-mgr[bot] wants to merge 1 commit into
mainfrom
update-lief-1.0.0

Conversation

@gominimal-pkgmgr-mgr

Copy link
Copy Markdown
Contributor

Update lief 0.17.61.0.0

Source: github:lief-project/LIEF
Release: https://github.com/lief-project/LIEF/releases/tag/1.0.0
Changelog: lief-project/LIEF@0.17.6...1.0.0
Released: 2 days ago (2026-07-12)

Pkgscan: clean — diff against the prior version surfaced no newly-introduced suspicious patterns.

Vulnerability impact

Partition analysis at 1.0.0 (uses each advisory's fixed-version, vulnerable-range, affected-ranges, and fix-commit ancestry to decide):

  • 1 cleared — the new version is outside the advisory's affected range, OR the tag's lineage includes a known fix-commit. These will drop off the next scan.

Vulnerabilities fixed (1)

This update clears 1 vulnerabilities affecting 0.17.6:

CVE / GHSA Severity Fixed in
GHSA-p84g-9fv8-52qw LOW 1.0.0

Components changed

CycloneDX component delta (declared materials — the package's own version, not a dependency-tree diff)
Component Old New
~ lief 0.17.6 1.0.0
~ lief-upstream 0.17.6 1.0.0

Changes

Old New
Version 0.17.6 1.0.0
SHA256 5fbbd19c85912d41... 2cf412695ff739d8...
Size 20.0 MB
Source https://github.com/lief-project/LIEF/archive/refs/tags/0.17.6.tar.gz https://github.com/lief-project/LIEF/archive/refs/tags/1.0.0.tar.gz
  • License: Apache-2.0 (source: GitHub + tarball)

Created by pkgmgr

@gominimal-pkgmgr-mgr gominimal-pkgmgr-mgr Bot added the auto-update Opened autonomously by pkgmgr auto-update label Jul 15, 2026
@bryan-minimal

Copy link
Copy Markdown
Member

Closing — lief 1.0.0 is a major bump and node (the only package that links lief, via --shared-lief) doesn't build against it, failing on both arches. lief exists in our tree solely to serve node's build, so bumping it ahead of node breaks the one consumer for no benefit. Holding at 0.17.6.

Longer-term lief-1.0 adoption tracked in #418. This is the reverse-dependency rebuild gate working as intended (see PACKAGE_UPDATE_SAFETY_2026-07-15.md) — a major dep bump caught by the clean-room rebuild of its consumer, before merge.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

auto-update Opened autonomously by pkgmgr auto-update

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant