Move regular releases after security release annoucement
Open
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 4.4k
- Forks
- 675
- Avg merge
- 22h 29m
- Merged PRs (30d)
- 1
Description
I believe we should not perform other releases after a security releases has been announced.
- It's confusing for users if a release comes out before the expected security release date.
- It's a vulnerable release, it makes it unusable for users knowing it has vulnerabilities.
- It disrupts the tooling. In the security release process, the tool requires to know in which patch a vulnerability will be fixed, and which is vulnerable. If a new release comes after we declared it in the
vulnerabilities.json, it becomes inaccurate. It requires coordination.
I propose we delay regular releases to after the security release.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing the security release process described in the issue and how vulnerabilities.json is used to identify vulnerable and fixed patches. Check whether the proposed release ordering requires changes to documented release coordination or tooling. Done means the policy and any affected process are clearly agreed and reflected in the relevant release workflow.
Written by the indexing model from the issue text.
Assessment
- Domain
- release
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100