Upcoming Drupal Core security release and Open Social

As you may have heard coming Wednesday (March 28th) a security issue for Drupal Core will be released. More information is available at https://www.drupal.org/psa-2018-001.

We will release a new version (1.12) of Open Social as soon as possible after the Drupal Core release is available. This Open Social release will only contain the Drupal Core security fixes. No other changes will be included.

Updating to Open Social 1.12

For updating to the, yet to be released, new version you can follow the normal update guide.

Alternative updating

Don't want to wait for Open Social 1.12 to be ready? It’s also possible to just update Drupal Core, even before the updated Open Social is released.

You’d have to add "drupal/core": "8.4.6 as 8.4.5" as a dependency to your composer file (assuming that the 8.4 fix is released as 8.4.6) and then run composer update --with-dependencies drupal/core

This will not update Open Social but it should update Drupal Core to the release with the security fix.

In the future this process will be easier when we merge https://www.drupal.org/project/social/issues/2946771.

Feel free to use the comments below for questions regarding this upcoming release.