5.4.0b1 release
diff --git a/CHANGES b/CHANGES
index f3facb1..28edc3c 100644
--- a/CHANGES
+++ b/CHANGES
@@ -4,6 +4,14 @@
* https://github.com/yaml/pyyaml/commits/
* https://bitbucket.org/xi/pyyaml/commits/
+5.4b1 (2021-01-13)
+
+* https://github.com/yaml/pyyaml/pull/407 -- build modernization, remove distutils, fix metadata, build wheels, CI to GHA
+* https://github.com/yaml/pyyaml/pull/472 -- fix for CVE-2020-14343, moves arbitrary python tags to UnsafeLoader
+* https://github.com/yaml/pyyaml/pull/441 -- fix memory leak in implicit resolver setup
+* https://github.com/yaml/pyyaml/pull/392 -- fix py2 copy support for timezone objects
+* https://github.com/yaml/pyyaml/pull/378 -- fix compatibility with Jython
+
5.3.1 (2020-03-18)
* https://github.com/yaml/pyyaml/pull/386 -- Prevents arbitrary code execution during python/object/new constructor
diff --git a/announcement.msg b/announcement.msg
index 1e32b3c..0835b66 100644
--- a/announcement.msg
+++ b/announcement.msg
@@ -1,25 +1,36 @@
-From: Tina Müller <post@tinita.de>
+From: Matt Davis <mrd@redhat.com>
To: python-list@python.org, python-announce@python.org, yaml-core@lists.sourceforge.net
-Subject: [ANN] PyYAML-5.3.1: YAML parser and emitter for Python
+Subject: [ANN] PyYAML-5.4b1: Linux and Mac users, please test!
-=======================
-Announcing PyYAML-5.3.1
-=======================
+=========================
+Announcing PyYAML-5.4b1
+=========================
-A new release of PyYAML is now available:
-https://pypi.org/project/PyYAML/
+A beta release of PyYAML is now available:
+https://github.com/yaml/pyyaml/releases/tag/5.4b1
-This release contains a security fix for CVE-2020-1747. FullLoader was still
-exploitable for arbitrary command execution.
-https://bugzilla.redhat.com/show_bug.cgi?id=1807367
+This release contains a security fix for CVE-2020-14343. It removes the
+python/module, python/object, and python/object/new tags from the FullLoader.
+YAML that uses these tags must be loaded by UnsafeLoader, or a custom loader
+that has explicitly enabled them.
-Thanks to Riccardo Schirone (https://github.com/ret2libc) for both reporting
-this and providing the fixes to resolve it.
+This beta release also adds Python wheels for manylinux1 (x86_64) and
+MacOS (x86_64) with the libyaml extension included (built on libyaml 0.2.5).
+We believe these wheels to be stable, but please take the opportunity to test
+against your local Linux and MacOS environments, and file any issues at
+https://github.com/yaml/pyyaml/issues.
+
+PyYAML 5.4 will be the last release to support Python 2.7.
+
Changes
=======
-* https://github.com/yaml/pyyaml/pull/386 -- Prevents arbitrary code execution during python/object/new constructor
+* https://github.com/yaml/pyyaml/pull/407 -- build modernization, remove distutils, fix metadata, build wheels, CI to GHA
+* https://github.com/yaml/pyyaml/pull/472 -- fix for CVE-2020-14343, moves arbitrary python tags to UnsafeLoader
+* https://github.com/yaml/pyyaml/pull/441 -- fix memory leak in implicit resolver setup
+* https://github.com/yaml/pyyaml/pull/392 -- fix py2 copy support for timezone objects
+* https://github.com/yaml/pyyaml/pull/378 -- fix compatibility with Jython
Resources
diff --git a/lib/yaml/__init__.py b/lib/yaml/__init__.py
index 6da15d8..4019363 100644
--- a/lib/yaml/__init__.py
+++ b/lib/yaml/__init__.py
@@ -8,7 +8,7 @@
from loader import *
from dumper import *
-__version__ = '5.4.0a0'
+__version__ = '5.4b1'
try:
from cyaml import *
diff --git a/lib3/yaml/__init__.py b/lib3/yaml/__init__.py
index 98b662c..97e90ad 100644
--- a/lib3/yaml/__init__.py
+++ b/lib3/yaml/__init__.py
@@ -8,7 +8,7 @@
from .loader import *
from .dumper import *
-__version__ = '5.4.0a0'
+__version__ = '5.4b1'
try:
from .cyaml import *
__with_libyaml__ = True
diff --git a/setup.py b/setup.py
index 296b599..ce41c81 100644
--- a/setup.py
+++ b/setup.py
@@ -1,6 +1,6 @@
NAME = 'PyYAML'
-VERSION = '5.4.0a0'
+VERSION = '5.4b1'
DESCRIPTION = "YAML parser and emitter for Python"
LONG_DESCRIPTION = """\
YAML is a data serialization format designed for human readability
