Release Notes¶
Each Muppy release has a page here. It tells you what the release changes for you: what is new, what behaves differently, and what you have to do — nothing about how the work was made. The releases are listed newest first in the menu on the left.
Understanding a Muppy version number¶
A Muppy version comes in one of these shapes. A release has a page of its own, a release candidate reads the page of the release it precedes, and nothing else has a page.
18.98.0 — a release. Three numbers and nothing else. This is what the pages here
document.
18.98.1 — a patch. A hotfix on 18.98.0. It is documented on the page of 18.98.0,
in a section of its own.
18.98.0-rc.2 — a release candidate. The second candidate for 18.98.0, delivered to
the customers who opted into vNext. It comes before the release and carries its content, so
it reads the page of 18.98.0 — marked as a preview until the release is cut.
18.97.0-beta.mkeyd-k8s.1 — a beta of a feature. The first beta of the feature
mkeyd_k8s — a chantier, a set of lots developed together — on top of the release
18.97.0, complete enough to be tested. It
is deployed by hand, never delivered, and has no page — read the page of 18.97.0 and treat
what follows as work in progress.
18.97.0-alpha.mkeyd-k8s.3 — an alpha of a feature. The third alpha of the same feature,
an earlier stage of it. No page either.
18.97.0-1-gdf5cd050 — a release plus a few commits. The base release is the first
part, the number in the middle counts the commits added since it, and the g marks a git
hash: here, 18.97.0 plus one commit whose short hash is df5cd050. No page of its own —
read the page of its base release, and treat what follows it as work in progress.
18.96.0-beta.3, 18.89.1-beta.next.2 — older shapes of branch builds. Still found on
some deployments. Read them as work in progress on top of the release their number names.
df5cd050 — a hash alone. The build comes from a branch rather than from a tag, and git
found no release to name it after.
How the branches produce these numbers is described in Branches and version numbers.
Where to read your version
The version of the instance you are using is in the user menu, top right. The instance
also serves it at /inouk_health_check — the form to use from a script, or to check a
server you are not logged into.
Security fixes¶
A Critical or High security fix to Muppy ships as a patch — 18.97.1 on top of
18.97.0 — so that the fix and its description are published together.
A Medium or Low fix may ship with the next minor release instead. From its first release candidate, the page of that release carries a heading Security fixes — details at release: the release contains security fixes, and their details are published with it. The details replace that notice when the release is out, the day you can install the fix. Until then, the page says that a flaw exists, never which one.
A fix is described under a heading that starts with Security fix, in the section of its patch or on the page of its minor release, and it states:
- Severity — Critical, High, Medium or Low, on the scale below.
- Affected versions — the releases that carry the flaw, and the release candidates when one was out.
- Fixed in — the patch or the release that carries the fix. Every later version carries it too. The customers in vNext receive a patch's fix with the next candidate, and a minor's fix with its candidates.
- What to do — upgrading to that version, or to any later one, applies the fix. Anything the upgrade does not do by itself, such as rotating a credential, is said there.
Each issue is described at the level you need to judge whether you are exposed and to apply the fix: the component, what someone could read, change or stop, who could do it and under which conditions. What would help someone exploit the flaw is left out.
| Severity | What it means |
|---|---|
| Critical | Someone with no account on your instance, or any logged-in user, could take control of Muppy, of the servers it manages or of the secrets it holds. |
| High | Someone could read or change what their rights do not cover, or stop a service, under conditions that are common. |
| Medium | The same kinds of harm, under conditions that are rare or demanding: an uncommon configuration, a feature few use, an account with high rights. |
| Low | Limited exposure: information of little value, or a weakness that matters only combined with another flaw. |
When a fix is Critical, the contact person of each Self-Hosting customer is also notified as soon as it is published.
These fixes cover Muppy itself. Extra modules installed alongside it and the third-party software Muppy runs on or deploys — Odoo, PostgreSQL, Kubernetes, the operating system and the other components it installs — are outside them: advisories for third-party software are issued by their own publishers.