A security issue requires a command-line upgrade, but some users aren’t seeing the “You have to do a command line upgrade” message on the upgrade page after rebuilding from the Docker container. Falco explained that the docker_manager needs to be updated first to see the message. However, some users, like geoff777 and Ed_S, successfully updated from the browser without seeing the message, raising concerns about the state of their Discourse instance. pfaffman initially reported the issue and Ed_S shared a similar experience where the update appeared successful, but a separate processes tab indicated a rebuild was still necessary.
It seems that this is a security issue that requires a command-line upgrade, but I’m seeing a forced rebuild on only a couple of the sites that I’ve checked, and those seem really old.
Continuing the discussion from 2.9.0.beta4: Security Fixes, Sitemaps, Discourse Connect Provider 2FA, and more:
I’ve checked a bunch of sites today and none of them has the “You have to do a command line upgrade” message on the upgrade page.
Is this a bug?
You have to update docker_manager first in order to see it. After you update the docker_manager, the next request to /admin/upgrade will show the message.
I updated an instance today from the console.
I expected to see a message but didn’t get one.
I did a ./launcher rebuild app just to be safe …
Darn. Ok. I guess the old one can’t know that until the upgrade.
This might explain something I saw: I did the docker update, navigated successfully back to the versions tab and then did the discourse update. All in browser and all apparently successful. But opening a new processes tab in another window showed me the static page telling me I needed to rebuild.
In a sense, I didn’t need to - and I haven’t. My discourse thinks it is fully updated. Is it? If it isn’t, what state is it in?