Update for 2018.11.3

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 8147c71039f775c8b10e6eceab78d43bb557bde5)
[Peter: drop Makefile changes]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

diff --git a/CHANGES b/CHANGES
index 8bae45cea84c187709a13361fa4efec0b947c964..38a59435d8301a9c389631b1aa23508927fc5f93 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -172,6 +172,36 @@
        #11656: Custom device tree and u-boot boot.scr not integrated..
        #11666: Touchscreen with (Py)Qt5 should use tslib instead of evdev
 
+2018.11.3, Released February 23th, 2019
+
+       Important / security related fixes.
+
+       Ensure the PLATFORM and OS environment variables are not set,
+       as they cause build issues for some packages.
+
+       The package list infrastructure now correctly handles packages
+       installing files with old mtime.
+
+       Linux: Skip hash checks for user supplied downloadable
+       patches, as no hash checksums are available for those.
+
+       scanpypi: protect against zip-slip vulnerability in zip/tar
+       handling
+
+       Download: fixes for SSH/SCP support
+
+       SDK: Fix handling of relative symlinks (targets starting with
+       '.' or '..')
+
+       Updated/fixed packages: bind, dhcpcd, docker-compose,
+       docker-containerd, docker-engine, dovecot, dovecot-pigeonhole,
+       dtc, efivar, ghostscript, gnuradio, imagemagick, jpeg-turbo,
+       libarchive, libb64, libcurl, libgeotiff, libgpiod, libid3tag,
+       libupnp18, log4cplus, madplay, meson, mosquitto, openssh, php,
+       poco, postgresql, proftpd, pulseaudio, python, python-django,
+       python3, qt5base, reaver, runc, sg3_utils, sqlcipher,
+       swupdate, systemd, unzip, webkitgtk, xenomai
+
 2018.11.2, Released January 30th, 2019
 
        Important / security related fixes.