Bug#959723: RM: matrix-synapse/0.99.2-6 -- ROM; security issues; obsolete version
On Mon, May 04, 2020 at 11:04:21PM +0200, Andrej Shadura wrote:
> On Mon, May 04, 2020 at 06:33:26PM +0200, Julien Cristau wrote:
> > > I think in this case it’s okay because of this NEWS entry:
> > >
> > > https://sources.debian.org/src/matrix-synapse/0.99.2-6/debian/NEWS/
>
> > I'm not sure how that makes it any better? NEWS is shown on upgrade at
> > best, so anyone installing this on buster won't see it.
>
> True; I haven’t thought about people who never had synapse installed
> before. In any case, I think anyone installing this on buster does
> follow the news about Matrix and probably tried to figure out how to
> upgrade.
Notifying users about an EOL package is handled by debian-security-support,
simply file a bug against it and the next time it lands in stable, people
will be notified who have it installed.
I'm all in favour of removing it by 10.4 or 10.5, depending on whether
the timing still allows for 10.4.
Cheers,
Moritz
Reply to: