update to upstream 6.7.4

security fix for CVE-2020-13379

grafana.rpmlintrc

@@ -1,6 +1,10 @@
 addFilter("W: non-standard-gid.* grafana")
 addFilter("W: non-standard-uid.* grafana")
 addFilter("E: script-without-shebang .*\.json")
-addFilter("E: zero-length .*\.scss")
+addFilter("E: zero-length /usr/share/grafana/public/.*")
 addFilter("W: log-files-without-logrotate .*")
 addFilter("W: no-documentation")
+addFilter("E: non-readable /etc/grafana/grafana.ini 640")
+addFilter("E: non-readable /etc/grafana/ldap.toml 640")
+addFilter("E: non-standard-dir-perm /var/lib/grafana 750")
+addFilter("W: dangerous-command-in-%post chown")

grafana.spec

@@ -15,7 +15,7 @@ end}
 %endif
 
 Name:             grafana
-Version:          6.7.3
+Version:          6.7.4
 Release:          1%{?dist}
 Summary:          Metrics dashboard and graph editor
 License:          ASL 2.0
@@ -619,6 +619,10 @@ export GO111MODULE=off
 
 
 %changelog
+* Fri Jun 05 2020 Andreas Gerstmayr <agerstmayr@redhat.com> 6.7.4-1
+- update to 6.7.4 tagged upstream community sources, see CHANGELOG
+- security fix for CVE-2020-13379
+
 * Tue Apr 28 2020 Andreas Gerstmayr <agerstmayr@redhat.com> 6.7.3-1
 - update to 6.7.3 tagged upstream community sources, see CHANGELOG
 - add scripts to list Go dependencies and bundled npmjs dependencies

sources

@@ -1,2 +1,2 @@
-SHA512 (grafana-6.7.3.tar.gz) = 04c77b80bc8239981364e188c0920a92a70d0988109b3a263b6852cc021d4351e6e731136edc3c3c09a96836545d2ce0df9db5dec4fed0c020e6b8226cc9ec21
-SHA512 (grafana_webpack-6.7.3.tar.gz) = 04f33f2adc0f6fa03f32e7c5522e59ff2543a5488b5d3bec7ee8c62a027e55aa0a772fb1354b19f8e580ebd07a73c7137d2810eca5e54b76d4394c669195978f
+SHA512 (grafana-6.7.4.tar.gz) = f05f09d476a8be4b7d331f8a769c3353b0fffd17b3317fe1c14aa8a776187cdfdf4b9a13fb58d0b40c7734f603af2c47220aa8c40797acad0258275705167166
+SHA512 (grafana_webpack-6.7.4.tar.gz) = 3182caa9fd7d9398b6cd3ed596558c2d051c99c359bd8de80f149e5fb55f7f003b5e7679786e8c9861b2afe1ddd5056c36b702145dd0a89d5d184cbe1e9b14bd