Cadence of security release does not match documentation
#25,559 opened on 2023/02/14
Repository metrics
- Stars
- (27,997 個のスター)
- PR merge metrics
- (PR metrics pending)
説明
It takes a lot of hard for from volunteers on the security team to put out a security release. The documentation in RELEASES.md suggest that security releases will happen quarterly. However the most recent security release was in June of 2022, which was 8 months ago. This leave the project in a position where there are open security bugs which have been unreleased for 9 months. This is not ideal.
This was discussed at the most recent Envoy Community meeting. The core issue seems to be that running the security release is a volunteer position. It seems likely that unless someone is hired specifically for this purpose, we will continue to see long periods between release. There were a couple of proposal for how to mitigate this situation.
- Only kick off a security release for Critical or High impact issues.
- Only backport fixes to the most recent stable branch
It would be a good idea to get consensus within the project for how we'd like to handle this.