We are planning to release security patches for versions 3.5, 4.0, 4.1 and nightly next Tuesday, Sep 19, at 15:00 UTC. We encourage server administrators to plan for a timely upgrade to ensure their Mastodon server is protected.
@MastodonEngineering@renchap if I am on nightly, do i have to wait a few hours for the next nightly to patch those CVEs or will there be an expedited, out-of-schedule nightly release?
@melroy@MastodonEngineering you should never need to clear the cache when upgrading.
And for this security release, you will not need to run migrations, only pull the new code and restart the services
@renchap@MastodonEngineering Thanks for your feedback. OK, I will remove the cache clear storage cache command. Since I use this script for all my upgrades, I always execute the db:migrate command (even if it's not needed). Of course before those commands I turn all services down, and after those commands I start them all again.
@renchap@MastodonEngineering Thanks good to know. I'm just using Docker Compose. If some admins use a decent Kubernetes cluster, you can basically get zero down-time actually. Since the load-balancer will then automatically switch clients from the old to the new version seamlessly.
@nico@melroy@MastodonEngineering No, patches will be disclosed and merged to main when we release the patches.
Releasing the patches might give informations about the security issues.
@melroy@nico@MastodonEngineering No, this is coordinated disclosure.
If we publish the fixes on main before releasing the patched versions, then a malicious person could try to find out what the issue is by looking at the fixes.
Everything will be released at the same time, fixes in git, patched versions, and security advisory.
This is standard practice.
Add comment