Post by @danog@phpc.social

The pre-announcement of the #PHP vuln was due to the legacy release cycle (warn people so they can upgrade manually), instead of the new standard in the AI security research era: vendors patch and release ASAP, users autoupdate by default.

Suggestions to release managers: drop the once-a-month release cadence for normal bugfixes, and tag security fixes even more often, even if it means 3 releases a day.

The current PHP release cadence is not viable anymore in the age of AI.

@thephpf

#php

1 Boost

0 Likes

malte

@malte@anticapitalist.party 22 min. ago

@danog @thephpf i'm auto-updating, but only once per day. so with a vulnerability like this, that window is a bit large?

Daniil Gentili

@danog@phpc.social 20 min. ago

@malte @thephpf It doesn't matter how often you update, since PHP currently does at most one release every 3 weeks.

Ben Ramsey

@ramsey@phpc.social 25 min. ago

@danog @thephpf The cadence will remain the same, but we might do more security releases, which are allowed to fall outside the cadence. Today’s release is one such example.

Daniil Gentili

@danog@phpc.social 22 min. ago

@ramsey @thephpf "Doing more security releases" = how often exactly? Once a week at most? With AI-based vulnerability research, I would allow at least one release a day.

Yes, it will feel like the release cadence of npm packages, but this must not be a blocker: people have to get used to autoupdating PHP.

Ben Ramsey

@ramsey@phpc.social 15 min. ago

@danog @thephpf That’s a big burden on the release managers, who are unpaid volunteers, each with day jobs that also require their time.

Daniil Gentili

@danog@phpc.social 8 min. ago

@ramsey @thephpf This is a completely automatable task, with an automatic CI workflow that automatically creates releases if a PR with the security label is merged.

This is a complete non-issue.

1 more reply

Daniil Gentili

@danog@phpc.social 23 min. ago

@ramsey @thephpf Will security releases postpone the regular releases?

I really want to avoid a situation where (potentially RCE-able now with AI) bugs like https://github.com/php/php-src/issues/10496 get postponed by 2 weeks or more due to security releases shifting the normal release cadence.

GitHub

8.2.2: segfault when garbage collector is invoked inside of fiber · Issue #10496 · php/php-src

Description Most likely caused by the changes in #9810 The following code: <?php use danog\MadelineProto\EventHandler; use danog\MadelineProto\Logger; use danog\MadelineProto\Settings; include 'ven...

Discussion

Discussion