admin/raven
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Security review: F5, F1 and F18 also fixed in 8.3.0; findings gate the release

Browse Source 
John's decision: 8.3.0 is not released until every finding is fixed or
explicitly accepted. The review therefore runs before the release, not after.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
John Cardinal
2026-10-23 19:58:31 -07:00
parent ee6def1932
commit 2fca018add
2 changed files with 6 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
devdocs/modernization/SECURITY-REVIEW.md
View File

@@ -208,7 +208,9 @@ Status: *candidate* (seen in code, not yet confirmed), *confirmed*, *fixed in ca
**Release decisions.** John, 2026-10-23: **F13 to F17 are urgent and are fixed in 8.3.0**, as
"next release" cases (case numbers to come). Hosted and self-hosted perpetual installations
matter equally; how many use customer contact logins is unknown, so every installation is
assumed to. F5, F1 and F18 are recommended for 8.3.0 as well; awaiting John's decision.
assumed to. **F5, F1 and F18 are fixed in 8.3.0 as well** (John, 2026-10-23). John: "I won't
release until it's secure, all holes must be plugged": 8.3.0 waits for the findings of every
pass to be fixed or explicitly accepted by John.
### F5 2FA step skips the password (pass 2, confirmed on the local server)