Gitlab Critical Security Release

Re:Gitlab Critical Security Release by saxonww on Saturday February 26, 2022 @11:40AM (#30479098)

We've talked about this a lot internally. They make a big deal about releasing on the 22nd of every month, but they usually have to turn around and release a patch shortly thereafter. 14.8 is a bit of an extreme: 14.8.0 on the 22nd, 14.8.1 (bug fix) on the 23rd, then 14.8.2 (security) on the 25th.

We'd personally prefer to see a better release when it's done, vs. them keeping this farce of a 'release streak' going and then asking customers to install another upgrade within days.

[ Parent | on HN ]

Re:Gitlab Critical Security Release by 0xbadcafebee on Saturday February 26, 2022 @01:32PM (#30480294)

Seems like you could just wait a few weeks until upgrading to a new release?

[ Parent | on HN ]

Re:Gitlab Critical Security Release by kokey on Saturday February 26, 2022 @03:48PM (#30481825)

When I used to maintain a GitLab server I used to do exactly this by upgrading almost a month behind their schedule.

[ Parent | on HN ]

Re:Gitlab Critical Security Release by passerby1 on Saturday February 26, 2022 @09:17PM (#30484666)

The problem with this approach is being vilnerable to major zero-days (like 30k servers hack in Nov 2021) every month.

[ Parent | on HN ]

Re:Gitlab Critical Security Release by lbotos on Saturday February 26, 2022 @02:27PM (#30480923)

I've proposed to other customers who want less releases to track one minor version behind for the experience you are looking for. Still within security fix range, up-to-date and you will jump the the latest patch release (and none should follow unless it's a security release).

[ Parent | on HN ]

Re:Gitlab Critical Security Release by blyry on Saturday February 26, 2022 @07:40PM (#30483953)

I always ran 1 ( sometimes 2) point releases behind, never ever had an issue upgrading. Omnibus on Ubuntu.

[ Parent | on HN ]