Subject: [bug#69721] [PATCH v2] gnu: wget-next: Graft wget to v1.25.0, fixing CVE-2024-10524

From: Aaron Covrig <[email-masked]>
Date: Sat, 23 Nov 2024 15:38:33 -0500

* gnu/packages/wget.scm (wget-next): new variable, graft wget
---
Hello all,

I have combined the most recent patch commit as it was done as a diff
against the original commit. Further more, I believe the reason the
update was done as `wget-next` is to allow it to be grafted in since
wget is a dependency for so many packages; to this end I have also updated
the commit to apply as a graft (for reviewers, this is my first time
submitting a patch using a graft, so I may have missed something).

 gnu/packages/wget.scm | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/gnu/packages/wget.scm b/gnu/packages/wget.scm
index 4bd4d3c87a..dc48fb1eb7 100644
--- a/gnu/packages/wget.scm
+++ b/gnu/packages/wget.scm
@@ -47,6 +47,7 @@ (define-public wget
   (package
     (name "wget")
     (version "1.21.4")
+    (replacement wget-next)
     (source
      (origin
       (method url-fetch)
@@ -74,6 +75,18 @@ (define-public wget
 in downloaded documents to relative links.")
     (license license:gpl3+))) ; some files are under GPLv2+
 
+
+(define-public wget-next
+  (package
+    (inherit wget)
+    (version "1.25.0")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (string-append "mirror://gnu/wget/wget-" version ".tar.lz"))
+       (sha256
+        (base32 "07waw3s51zmjqzqq717xyyd353qc1ajcd38lh7y8i85hav3mq8hr"))))))
+
 (define-public wgetpaste
   (package
     (name "wgetpaste")

base-commit: 36f516bfcdf64185f5d70c21a908283be22a34fd
-- 
2.46.0