Hi Rüdiger, Fine by me, I'll work there.
On git: it would help. I'm not a committer, so the work arrives as patches either way, and on git they'd come as reviewable pull requests. Happy to do whatever legwork a migration needs. The AI cross-check is done. No vulnerability under httpd's security model: the two historical CVEs are still correctly fixed, gcc -fanalyzer is clean across the sources, and ASan/UBSan reported nothing on the client-input paths (large and chunked bodies, temp-file spill, oversized headers). It found five hardening items, all out of model - trusted backend, local access, or admin config - so there is nothing for security@. I'll send those as ordinary patches. On Joe's point about a release: if a PMC member wants to run one, I'll prepare whatever helps - CHANGES, the open fixes, testing on Linux and Windows - so there is as little left to do as possible. Regards, Jamal Le mar. 3 nov. 2026 à 13:25, Ruediger Pluem via dev <[email protected]> a écrit : > > > > On 11/3/26 12:27 PM, Jamal TANTAOUI wrote: > > Hi Rüdiger, Joe, > > > > Thanks, that's clear, and agreed on keeping the history. > > > > Leaving it as it is isn't neutral, though: it still runs on thousands > > of servers (Debian's popularity contest alone counts about 3,700 > > installs). I'd like to take care of it: bug reports, fixes and tests, > > and security reports with the security team. I depend on it in > > production on Windows, where there is no PHP-FPM. > > > > So I'll start with what you suggest: tests, the open fixes and an AI > > cross-check of the code, with anything security-relevant going to > > security@ first. I'll mark the PR as a draft until then. Where would > > you rather see that work, on the PR branch or as patches against the > > mod_fcgid repository? > > I would say in its current location, which is Subversion based. > I am not sure how much effort it would create to get it to git short term > if this helps. But I guess it is less complex than httpd due to a lack > of larger release scripts and other stuff that caused additional effort with > httpd. > > Regards > > Rüdiger >
