Repository navigation
request: backport msgpack 1.2.4 support to stable branch #10585
Description
Alpine Linux recently upgraded msgpack to 1.2.4 and now borgbackup (1.4.5) will not run[1]. Rather than require distros to pin msgpack to some old version in the past just for borgbackup, it would be nice if the recent patches for supporting the latest version were backported to the stable release branch since it seems like borg 2.0 is still a ways out.
Reacted by Michal Čihař
Activity
infectormp commentedon Nov 2, 2026
it's already there #10552
craftyguy commentedon Nov 2, 2026
nice. it's just not in a tagged release yet. are there any plans to tag a new stable release soon? :)
ThomasWaldmann commentedon Nov 2, 2026
I am still waiting for some CVE numbers from github, but after that, there will be a 1.4.6 release.
nijel commentedon Nov 2, 2026
In my experience waiting for CVE from GitHub can be around two months now for unpublished advisories. So consider if waiting is good approach.
ThomasWaldmann commentedon Nov 3, 2026
@nijel That sounds like gh cve assignment is too slow to fulfill its purpose. :-( Any way to speed it up?
nijel commentedon Nov 3, 2026
They are just overloaded. Publishing the advisory will prioritize the assignment in my experience. I use GHSA links in the release notes when publishing the release and accomply them with CVEs once they are available.
PS: With some projects we also started to publish advisories for high and critical vulnerabilities only to reduce noise for users and load on CNA.
ThomasWaldmann commentedon Nov 3, 2026
Yeah, I will also just use the GHSA id or link in the release note and won't wait for the CVE.
ThomasWaldmann commentedon Nov 3, 2026
Closing this, already fixed in 1.4-maint.