CVE-2024-53920 describes an arbitrary code execution vulnerability
during macro expansion, which occurs during byte-compilation or when
evaluating macro calls in uncompiled elisp files.
Flycheck and flymake use byte-compilation to lint elisp files, exposing
users to this vulnerability. This commit attempts to protect users from
this by disabling both in elisp files that aren't part of a
project (because, presumably, untrusted elisp won't live in a project).
What a "project" is depends on your projectile settings, but generally
means a file that lives in a version controlled directory and/or a
directory containing a recognizable project root marker (like a
packages.json or Cargo.toml file).
This heuristic won't catch cases of untrusted elisp living within
legitimate projects, or the case where the user's $HOME is a project and
*all* their elisp files live under it, but there are already too many
ways to shoot yourself in the foot with Emacs to begin with, and
disabling fly(check|make) altogether stands a higher chance of making
people blindly re-enable them to "work around" the fact it's not
"working as expected", bringing them back to square one.
Anyhow, long story short, don't open elisp files you don't trust in
Emacs, mkay?
Ref: CVE-2024-53920
These optional dotfiles indicate the root of a module or module
group (:lang), and will later contain module metadata. They will also
serve as an alternative to packages.el and doctor.el, and will aide the
parts of the v3.0 module API concerned with resolving the current module
from a path (`doom-module-from-path`), which currently rely too heavily
on parsing path strings.
For now, however, they're simply placeholders.
popen is a dependency of flymake-popen, and is on nongnu-elpa, which
wasn't supported by straight until recently, so the package! statement
is no longer needed.
Ref: 71469d8056
Moving the cursor over a flycheck-highlighted error will display the
error message in a popup. Displaying that popup could clear the active
selection (#7242), which is disruptive. This only affected non-Evil
users and users not using the module's +childframe flag, but should no
longer affect anyone after this commit.
Fix: #7242
Ref: flycheck/flycheck-popup-tip#14
BREAKING CHANGE: This deprecates the IS-(MAC|WINDOWS|LINUX|BSD) family
of global constants in favor of a native `featurep` check:
IS-MAC -> (featurep :system 'macos)
IS-WINDOWS -> (featurep :system 'windows)
IS-LINUX -> (featurep :system 'linux)
IS-BSD -> (featurep :system 'bsd)
The constants will stick around until the v3 release so folks can still
use it -- and there are still some modules that use it, but I'll phase
those uses out gradually.
Fix: #7479
doom-etc-dir will be renamed to doom-data-dir, to better reflect its
purpose, and align it with XDG_DATA_HOME (where it will be moved to in
v3, where Doom will begin to obey XDG directory conventions more
closely).
featurep! will be renamed modulep! in the future, so it's been
deprecated. They have identical interfaces, and can be replaced without
issue.
featurep! was never quite the right name for this macro. It implied that
it had some connection to featurep, which it doesn't (only that it was
similar in purpose; still, Doom modules are not features). To undo such
implications and be consistent with its namespace (and since we're
heading into a storm of breaking changes with the v3 release anyway),
now was the best opportunity to begin the transition.
doom-enlist is now a deprecated alias for ensure-list, which is built
into Emacs 28.1+ and is its drop-in replacement. We've already
backported it for 27.x users in doom-lib (in 4bf4978).
Ref: 4bf49785fd
I've omitted docs/*.org from this merge, as there is still work left to
do there, but I am pushing the module docs early so folks can benefit
from the new docs sooner.
Adding `Cannot add [word] to any active dictionary` error to the
troubleshooting section.
I have had this problem multiple times now when I break my emacs and
wipe the `~/.config/emacs` directory and I can never remember what file
to create to get my spell check working properly.
Even though this is a bug and might be fixed in the future, I feel like
having it documented can be helpful in the short term and in the future.
Ref: #6246
Did I already mention that this `latex-mode` slash `LaTeX-mode`
ambiguity was a reeeeeeally bad decision upstream? Anyways, this very
small PR also loads `writegood-mode` with AucTeX, which uses
`LaTeX-mode`, and not `latex-mode`.
Fewer links means less confusion.
- Merge doom-issue and doom-commit links into doom-ref (for auto-linking
Issue/PR/commit references).
- Merge doom-module-source and doom-docs-source links into doom-source.
- Rename doom-report-issue to doom-report.
- Use '!' as the icon for module issues link.
- Remove doom-repo (replaced with "doom:*" in :lang org module).
- Add doomdir and emacsdir links to :lang org module.
