Re: Emacs 29.3 released

[Ihor Radchenko <yantar92@posteo.net>]

Michael Albinus <michael.albinus@gmx.de> writes:

>> May it be an option to follow what Org mode does?
>> We have a stable branch that we periodically tag as a bugfix release
>> (weekly, if there are new commits).
>> Only tagged bugfix releases are merged to Emacs upstream.
>> The same bugfix releases go to ELPA.
>
> Tramp does something similar on GNU ELPA. It pushes bug fix releases
> with a dedicated version. It happens monthly only, submissions to Tramp
> happen less frequently.
>
> However, it doesn't push the same bugfix release to the emacs-29 branch,
> because not every bug fix is essential while Emeca is in pretest.

I see. So, you effectively have to "bugfix" versions - one with
hand-picked commits for Emacs pretest and one with more commits for
ELPA.

Maybe you can split the versions into Emacs-only and, fuller, proper
bugfix. Say, something like
Tramp 2.6.2.<emacs>.<N> and Tramp 2.6.2.<elpa>.<N>
Then, if emacs=1 and elpa=2, you will always get ELPA version to be
newer compared to Emacs pretest version.

But it is getting complicated... Not sure if it is worth layering the
versions that much.

>>> (FWIW, I don't understand yet why 29.3 was such an emergency that it was
>>> released w/o any warning in advance.)
>>
>> CVE.
>
> I haven't seen any CVE number in the announcement.

https://security-tracker.debian.org/tracker/CVE-2024-30203

The Emacs release was the announcement, and the first public disclosure
of the vulnerability.

-- 
Ihor Radchenko // yantar92,
Org mode contributor,
Learn more about Org mode at <https://orgmode.org/>.
Support Org development at <https://liberapay.com/org-mode>,
or support my work at <https://liberapay.com/yantar92>