envoyproxy/envoy

Cadence of security release does not match documentation

Open

#25,559 opened on 2023年2月14日

GitHub で見る
 (3 comments) (0 reactions) (0 assignees)C++ (5,373 forks)batch import
area/releasearea/securityenhancementhelp wanted

Repository metrics

Stars
 (27,997 stars)
PR merge metrics
 (平均マージ 8d) (30d で 378 merged PRs)

説明

It takes a lot of hard for from volunteers on the security team to put out a security release. The documentation in RELEASES.md suggest that security releases will happen quarterly. However the most recent security release was in June of 2022, which was 8 months ago. This leave the project in a position where there are open security bugs which have been unreleased for 9 months. This is not ideal.

This was discussed at the most recent Envoy Community meeting. The core issue seems to be that running the security release is a volunteer position. It seems likely that unless someone is hired specifically for this purpose, we will continue to see long periods between release. There were a couple of proposal for how to mitigate this situation.

  • Only kick off a security release for Critical or High impact issues.
  • Only backport fixes to the most recent stable branch

It would be a good idea to get consensus within the project for how we'd like to handle this.

コントリビューターガイド