For example, I’m on 2026.4.2 which is reported as fixing 25 security bugs compared to 2026.4 As 2026.4.2 is very recent, I’d expect it to have backports of most or all security fixes found in 2026.6 which was released at about the same time. But no, again I see 25 security bugs fixed. I rather sus…

This will solve it: Do not show already-fixed security advisories in comparisons (#25) main ← security-range merged 02:32PM - 02 Jul 26 UTC (UTC) [תמונה] …

[תמונה] Ed_S: As 2026.4.2 is very recent, I’d expect it to have backports of most or all security fixes found in 2026.6 which was released at about the same time. It does have backports, and I think that’s the issue… we’re only looking forward from 2026.4.2 → 2026.6 and pulling “these are the…

Yeah that’s exactly right, it’s just an artefact of how the release site does the comparisons. We backport all security fixes to all currently-supported releases. I’ll see if we can add some logic to make the cross-release comparisons work better on the site :eyes:

Thanks - can confirm that no security fixes are now shown from 2026.4.2 to 2026.6 which is as expected. A related question, though. On the releases page the presently in-progress 2026.7 offers two links: [image] The second of those takes us to [תמונה] v2026.7.0-latest Changelog | Discou…

[תמונה] Ed_S: which presently shows 11 security fixes, relative to v2026.6.0-latest. Is that right? Yes. 2026.6.0-latest came before 2026.6.0, and most commits labelled 2026.6.0-latest are vulnerable to these security issues. So if people are running 2026.6.0-latest, they need to update to 2…

[תמונה] david: most commits labelled 2026.6.0-latest are vulnerable to these security issues Hmm, OK, I see that, thanks. I was expecting the actual label for -latest is sitting at the latest version of that flavour. The actual problem I’m trying to solve, or the question I will regularly be…

[תמונה] Ed_S: I’m hoping to get a list of fixes which are in that later version, relative to my current version, and then read up on them to see if they apply or if they look severe. If you use the ‘advanced’ section at the top of the changelog, you can specify specific commits. Recently, we …

Thanks… I’m not seeing a ‘security fixes’ section there - specifically, say, in this case. (That’s the version in use by a specific forum I use.)

Thanks for the example link. Problem with unsupported-release comparisons is now fixed , so you’ll see all the security issues you’re affected by :sweat_smile: [image]

Ah, that’s great - thanks. One more observation - I’d prefer it if the Highlights section could be collapsed, or if the Fixes box could come ahead of it in the page.

Yeah, that would be useful in this case, given the number of new highlights. Although I do have to stress: comparing from a version that’s been totally unsupported for more than a year shouldn’t really be a common thing :sweat_smile:

Confused about security fixes as reported at releases.discourse.org

תמיכה

david (David Taylor) 6 ביולי,‏ 2026,‏ 9:24am 11

If you use the ‘advanced’ section at the top of the changelog, you can specify specific commits. Recently, we introduced links to that format at the top of the admin dashboard for self-hosted sites:

נושא		תגובות	צפיות
⚠ v2026.3.0-latest.1 has 33 security fixes, is already 6 days old Support	8	353	26 במרץ,‏ 2026
Any release notes (not just commit log) available? Support	4	1013	23 באפריל,‏ 2019
January 2026 Releases Announcements release-notes	15	1330	3 בפברואר,‏ 2026
What changed in each stable point release? Support	4	1058	26 במאי,‏ 2016
July 2026 monthly release Announcements release-notes	13	294	29 ביולי,‏ 2026

Confused about security fixes as reported at releases.discourse.org

נושאים קשורים