Inkscape possible domain compromise

[TLATER]

@waffle8946

Do we simply wait on the version bump then until they make some public statement?

I think that’s prudent.

@waffle8946

And how do we handle if someone has overrides set and don’t know about this issue?

What override would get them a potentially malicious update without spotting this themselves? If they rely on older versions they’re still protected by the hash, and if they deliberately upgrade to 1.3 they’re in the hands of upstream.