Re: Fixing security vulnerabilities before new releases (was: Emacs 31 release-blocking bugs)

Sean Whitton <[email protected]> Wed, 29 Jul 2026 13:45:30 +0100
Newsgroups gmane.emacs.devel
Message-ID <[email protected]>
Eshel Yaron [29/Jul  2:25pm +02] wrote:
> Releasing a new version invites more users to install and use it,
> and encouraging users to run vulnerable software is at best a disservice.
> True, it wouldn't make things worse for users who are already running a
> vulnerable version, but I don't think that's the right bar to aim for.
> Instead, we should make sure we make things better for them, by providing
> a version that mitigates this issue ASAP.  AFAICT, releasing a vulnerable
> Emacs 31.1 would delay that mitigation unnecessarily.

I think your argument applies only to people who are prompted to try
Emacs for the first time when we release Emacs 31.  These are a small
minority.

-- 
Sean Whitton