This is a weird comparison, but they should adopt the same release policies as Drupal. Security releases are done separate from maintenance releases, even if they are released at the same time.
That allows you to provide the security releases as a separate patch file so you can apply individually. You can skip maintenance releases that cause problems but still keep things secure.
Comments
This is a weird comparison, but they should adopt the same release policies as Drupal. Security releases are done separate from maintenance releases, even if they are released at the same time.
That allows you to provide the security releases as a separate patch file so you can apply individually. You can skip maintenance releases that cause problems but still keep things secure.
Here's a pointer to the security fixes in the release as a monkeypatch to 3.2.12, without any of the other cruft:
https://github.com/discourse/discourse/blob/master/lib/freed...
The discourse folks who threw this together have an app (Rails-based forum software) that was hit very hard by the performance regressions.
The rails team already does this. Here's an example patch for one change:
https://groups.google.com/forum/#!msg/ruby-security-ann/o0Ds...
Unfortunately that wouldn't have avoided this issue, as the problem was actually with the small security patch.