I self-host discourse. But I do not like to deploy unstable releases (betas or even worse: from tests passing). However, it seems that discourse only includes security fixes in these unstable releases. So server administrators who prefer to deploy only from stable releases miss out on potentially critical security updates. A recent example of this is the 2.7.0 beta5 which includes one security fix. The latest stable release was 29 days ago ( v2.6.3 ) but the release with the security fix was only made available on the v2.7.0.beta5 (published 23 days ago). Because of this I get the following warning on my dashboard: [critical] And in order to receive this security fix I have no choice but to update to a beta… Discourse is an awesome piece of software and I understand that CDCK deploys unstable branches (tests-passing) to their customers. However, I start this thread out of concern that some system administrators will miss out on critical updates… With this, I would ask the discourse team for back-porting medium/high security updates, issuing a stable version with that security fix ASAP.

Stable builds do receive security fixes as warranted. Not every security fix mentioned in the beta release notes requires backporting, however. Some may be trivial/minor, and not worth the effort/risk to backport. Others may medium/critical, but are due to change from an earlier beta such that the security vulnerability doesn’t exist on stable. In the current example from 2.7.0.beta5, the vulnerability could only be exploited under specific circumstances, on sites that had deviated from default secure site settings. As such, it was decided not to be backported, due the the risk of introducing unexpected bugs/change, which we try to avoid on the stable branch.

I believe it’s you specified the stable branch then it wouldn’t be recommending the upgrade. Many more sites run tests passed than stable or beta (including cdck hosting), so tests-passed is in some ways safer than stable. Because of that, I think it’s more work to run stable. That said, those who run stable frequently speak well here of how good they are at backporting critical fixes.

Backporting security fixes onto stable releases

Product Support

core April 3, 2021, 10:50am 3

Fair enough. Thanks for the explanation.

Topic		Replies	Views
Stable Release Channel Product Support	6	2522	June 17, 2020
When should I switch from beta release to stable release? Product Support	6	2756	August 27, 2018
Is now the best time to upgrade to a stable release? Product Support	10	1026	January 12, 2023
Should I be running beta or release? Product Support	4	1369	February 5, 2017
Switch from beta to stable releases Product Support	4	3124	September 5, 2019

Backporting security fixes onto stable releases

Related topics