Public release of LyX version 2.5.2
===================================

We are pleased to announce the release the LyX 2.5.2, the second maintenance
release in the 2.5.x series.

This release is somewhat special. Apart from usual bag of bugfixes we also
include number of fixes to vulnerabilities dicovered in cooperation with AI
tools.

We strongly urge our users to upgrade from previous releases, especially
if they routinely use/exchange .lyx documents with external parties.
In previous versions of LyX, malformed .lyx documents can cause arbitrary
execution of shell commands upon .lyx load or within export processing.

As the capabilities of frontier AI models quickly develop this might not
be the last such release and we suggest that users employ extreme caution
when dealing with files from untrusted sources.

This release fixes a number of mostly minor bugs in 2.5.1. One important fix
solves the regression introduced in 2.5.1 which caused LyX not to store Qt
session configuration (e.g. size and position of windows).

If you think you may have found a bug in LyX 2.5.2, either email the developers'
mailing list (lyx-devel at lists.lyx.org), or open a bug report at
  https://www.lyx.org/trac/wiki/BugTrackerHome
Please specify if the behavior you are reporting is different from behavior in
a previous LyX version. Please note that we have had to disable registration
for new accounts due to spam. If you would like an account, email the LyX
developers' list.

If you have trouble using LyX or have a question, consult the documentation
that comes with LyX (under Help) and the LyX wiki, which you will find at
https://wiki.lyx.org/. You can also send email to the LyX users' list
(lyx-users at lists.lyx.org).

The LyX team.
https://www.lyx.org


What's new
==========

** Updates:
***********

* SECURITY HARDENING FIXES

- Load-triggered arbitrary command execution vulnerabilities fixes:
   - 00a: kpsewhich shell injection via filename
   - 00b: lyx2lyx shell injection via filename
   - 00c: graphics-extension name shell injection
   - 00h: import-path filename shell injection into converters

- Export/View triggered arbitrary command execution vulnerabilities fixes:
   - 00d: bibtex command shell injection
   - 00e: index command shell injection
   - 00g: mangled filenames shell injection
   - 00i: convert-pdf helper shell injection
   - 00k: paperwidth/height injection causing arbitrary files rewrite

- New consent authorization gate for unpatched external tools
  - 00de:  processing gate prompts before running a code-capable bib/index tools
           (biber/xindy/xindex) on an untrusted document,
           The real fixes are upstream (biber 2.22, xindex 1.07, xindy from up-to-date
           TL tree), while the gate is LyX's interim guard.
           For biber 2.22 the gate automatically relaxes to no-op.
  - 00de-2: xindex version check relaxing the gate above.


* DOCUMENT INPUT/OUTPUT

- Issue an error on @ catcode mismatch by layout definitions (bug 13275)


* MISCELLANEOUS

- LyX now supports the Elsevier CAS classes.

* TEX2LYX IMPROVEMENTS

- Add support for \colorlet if the second arg is a known LaTeX or custom
  color (bug 13310).


* USER INTERFACE

- Implement LFUN_REFERENCE_TO_PARAGRAPH for mathed (bug 13206).

- It is now possible in the tabular creation dialog (Inset > Table) to
  insert a multi-page table (optionally with caption) directly.

- Simple search within selection now remembers the initial selection
  beyond the first match (bug 13293).

- Fix session information not being properly restored. This regression
  introduced was introduced in 2.5.1 as a side effect of fixing macOS
  crash on exit and new fix should fix both issues.


* BUILD/INSTALLATION

- Use inkscape as fallback png->eps converter if ImageMagick is not
  available or IM policy does not allow for png->eps conversion.



** Bug fixes:
*************

* DOCUMENT INPUT/OUTPUT

- Fix problem with nesting of languages.

- Fix closing of local CJK language with polyglossia (bug 13315).

- Prevent duplicate theorem definitions (bug 13302).

- Fix case where the colortbl package has been loaded unnecessarily
  (bug 13306).

- Fix order of theorem definitions for pandoc processing (bug 13307).

- Fix support for import/export of ODT documents using pandoc.


* USER INTERFACE

- Fix crash when selecting inset (bug 13294).

- Fix assertion when closing buffer with listings settings dialog open.

- Consider longtable caption when adding new column (bug 13299).

- Load externally referred buffers and initialize their labels.

- Fix pasting of cross-references in math (bug 13290).

- Fix pasting from LaTeX with keepEmpty environment in first paragraph
  (bug 13295).

- Fix casing of strings in English localization (bug 13304).

- Fix background color drawing for non-center aligned tabular cells.

- Fix on-screen representation of "pagewidth" length (bug 13309).

- Fix sorting of colors in preferences.

- Fix zoom-in/out functions so that the inverse (e.g. with the mouse wheel)
  end up at the exact same value (bug 13327).


* TEX2LYX

- Fix import of table with linebreak in column specification.

- Fix parsing of more complex column specification.

- Error if TeX file has a preamble but no (accessible) \begin{document}
  (bug 13297).
