Confused about security fixes as reported at releases.discourse.org

david · July 2, 2026, 1:03pm

This will solve it:

github.com/discourse/discourse-releases

Do not show already-fixed security advisories in comparisons (#25)

main ← security-range

merged 02:32PM - 02 Jul 26 UTC

davidtaylorhq

+201 -25

Previously we would show all security advisories which were 'fixed' during the c…omparison range. Since security fixes are backported, that meant that security advisories would show up in comparisons, even though they were already fixed in the `startRef`. This commit updates the logic so that we only show security advisories when the 'startRef' is vulnerable, and the 'endRef' is not.

Topic		Replies	Views
⚠ v2026.3.0-latest.1 has 33 security fixes, is already 6 days old Support	8	343	March 26, 2026
Any release notes (not just commit log) available? Support	4	1013	April 23, 2019
January 2026 Releases Announcements release-notes	15	1319	February 3, 2026
What changed in each stable point release? Support	4	1058	May 26, 2016
Backporting security fixes onto stable releases Support	3	579	April 3, 2021

Confused about security fixes as reported at releases.discourse.org

Related topics