profiles: p.mask old gnucash for now instead of outright removing them

I don't want to remove gnucash-2.6 without an explicit ack from
titanofold, but I do want to proceed with p.masking the vulnerable
webkit-gtk SLOTs. So put gnucash-2.6 in p.mask for now, until Aaron
removed it himself completely, hopefully soon. gnucash-docs is left
unmask for users that had it to still have it and upgrade to 3.0 docs
later on automatically (there don't appear to be any explicit gnucash
deps in gnucash-docs itself).

Bug: https://bugs.gentoo.org/629114

diff --git a/profiles/package.mask b/profiles/package.mask
index 6510d3ebda1dea37fa19a8c7d89914f68b8cbe8e..b434750712e5f2fa485754dd3ad4716b1559a6db 100644 (file)
--- a/profiles/package.mask
+++ b/profiles/package.mask
@@ -29,6 +29,12 @@
 
 #--- END OF EXAMPLES ---
 
+# Mart Raudsepp <leio@gentoo.org> (23 Feb 2018)
+# Older versions of GnuCash use security vulnerable old webkit-gtk slot.
+# Use gnucash-2.7.4 or newer instead, but pay attention to the news item:
+# https://www.gentoo.org/support/news-items/2018-01-14-gnucash.html
+<app-office/gnucash-2.7
+
 # Steve Dibb <beandog@gentoo.org> (22 Feb 2018)
 # Very old project of mine, hasn't worked in years, no plans to
 # support, and mpv can provide resume playback by default.