Confused about security fixes as reported at releases.discourse.org

david · July 2, 2026, 1:03pm

This will solve it:

github.com/discourse/discourse-releases

Do not show already-fixed security advisories in comparisons (#25)

main ← security-range

merged 02:32PM - 02 Jul 26 UTC

davidtaylorhq

+201 -25

Previously we would show all security advisories which were 'fixed' during the c…omparison range. Since security fixes are backported, that meant that security advisories would show up in comparisons, even though they were already fixed in the `startRef`. This commit updates the logic so that we only show security advisories when the 'startRef' is vulnerable, and the 'endRef' is not.

Topic		Replies	Views
⚠ v2026.3.0-latest.1 has 33 security fixes, is already 6 days old Support	8	338	March 26, 2026
June 2026 monthly release Announcements release-notes	3	249	July 2, 2026
Any release notes (not just commit log) available? Support	4	1009	April 23, 2019
Backporting security fixes onto stable releases Support	3	576	April 3, 2021
3.2.4: Security and bug fix release Announcements release-notes	0	355	July 15, 2024

Confused about security fixes as reported at releases.discourse.org

Related topics