Subject: Re: [bug#48656] [PATCH] gnu: lz4: Add a patch for CVE-2021-3520.

From: Leo Famulari <[email-masked]>
Date: Tue, 25 May 2021 15:07:05 -0400

On Tue, May 25, 2021 at 08:24:07PM +0200, Solene Rapenne via Guix-patches via wrote:
> This imports a patch that is not committed upstream yet
> but pending for merge on github
> 
> https://github.com/lz4/lz4/commit/8301a21773ef61656225e264f4f06ae14462bca7
> 
> This is already widely used in many distributions distributing lz4
> 
> ---
>  gnu/packages/compression.scm                 |  7 +++++--
>  gnu/packages/patches/lz4-CVE-2021-3520.patch | 15 +++++++++++++++

When adding a new patch file, you have to register it in 'gnu/local.mk'.

Is there any discussion about this upstream? Why isn't it included in
lz4 yet?