On Tue, Oct 27, 2026 at 4:40 PM, Kevin Fenzi wrote:
> Anyhow, I am just saying that "Oh, it's a CVE, push it immediately without
> testing it" is a bad idea and things are more nuanced. We should treat CVEs
> like any other bug and maintainers should evaluate how important it is to get
> them through the regular process.
Most userspace CVEs are indeed really boring, and not worth worrying about. We
should fix them sooner rather than later, because it's often hard to tell how
severe an issue really is. But no need to panic.
A few CVEs are known to be dire emergencies. When creating a bodhi update to
fix an emergency, be sure to set Severity: Urgent. That tells GNOME Software to
immediately prepare an update (when it completes its daily check for available
updates), instead of waiting until 2 weeks after the previous update before
preparing the update. Rushing to create a bodhi update does no good if Software
does not prepare it for 2 weeks.
--
_______________________________________________
devel mailing list -- [email protected]
To unsubscribe send an email to [email protected]
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedoraproject.org/archives/list/[email protected]
Do not reply to spam, report it:
https://forge.fedoraproject.org/infra/tickets/issues/new
