Security Issue Release process

Last updated on
21 November 2017

Schedule

When picking a Wednesday for a release date, be sure to consider major holidays or times when people are unlikely to be working. Holidays or other events that will postpone a security release include:

  • DrupalCons
  • Thanksgiving in the USA (fourth Thursday in November).
  • The end/beginning of the Gregorian year (i.e., around Christmas and New Year's)

Place, date and time

For Drupal security team members only, we coordinate in irc:

  • Place: #drupal-security (see “Using IRC” section for more details)
  • Date: Advisories are released on most Wednesdays.
  • Time: From 12:00 GMT-5 (Americas/New York)

Policy on committing fixes - the release window

It is ideal to coordinate with contrib maintainers to release SAs so that the commit, the creation of the release node, and publishing of the SA all happen within minutes of each other.
However it is often very difficult to get hold of maintainers on the day of the release. In order to make the coordination easier, maintainers should commit the fix up to 24 hours in advance of the release time.