security patches should not be listed on a private mailing list before they are part of a release
Best Regards Alin On Sat, 31 Oct 2026, 15:06 Xiang Xiao, <[email protected]> wrote: > the security patch fixed by: > net/usbhost/fs: Harden malformed input handling by anchao · Pull Request > #21101 · apache/nuttx <https://github.com/apache/nuttx/pull/21101> > but it isn't merged into the master branch yet. > > On Sat, Oct 31, 2026 at 10:00 PM Alin Jerpelea <[email protected]> wrote: > > > please create a list of patches you would like to have included in this > > release > > > > Best regards > > Alin J > > > > On Sat, 31 Oct 2026, 14:58 Xiang Xiao, <[email protected]> > wrote: > > > > > Don't cherry-pick by default, except the security patch or requested > by > > > people in the verification phase. > > > > > > On Sat, Oct 31, 2026 at 7:25 PM Alin Jerpelea <[email protected]> > > wrote: > > > > > > > I am cherry picking bugfixes and security vulnerabilities for every > > > release > > > > in the stabilization phase. > > > > > > > > Please note that this time we have over 300 fixes due to the enhanced > > AI > > > > assisted productivity. > > > > > > > > I know that CI is under pressure but we still need to test and merge > > only > > > > after the patches complete succesfully the CI check > > > > > > > > If you have other suggestions please provide them here > > > > > > > > Best regards > > > > Alin J > > > > > > > > > > > > On Sat, 31 Oct 2026, 10:01 Xiang Xiao, <[email protected]> > > > wrote: > > > > > > > > > Alin and community, > > > > > I would suggest that we only cherry-pick the critical fix to the > > > release > > > > > branch, because: > > > > > > > > > > 1. The new patch may contain bug > > > > > 2. Waste CI and maintainer resource > > > > > > > > > > > > > > > Thanks > > > > > Xiang > > > > > > > > > > > > > > >
