Re: Security mailing list & process, was Re: My summary of the Git Contributors' Summit 2026

Hi Toon,

On Wed, 23 Sep 2026, Toon Claes wrote:

Johannes Schindelin [off-list ref] writes:

quoted

Security mailing list and process

[...]

Microsoft's release process reportedly needs about seven weeks. There
were no objections in the room to proceeding without waiting for that
schedule. (Personal note: That release process was misrepresented,
which is surprising

I wouldn't say this is surprising, I think most people just don't know
the details.

quoted

as I coordinated two or three Git for Windows security bugfix releases
_on the git-security list_ since the most recent Git security bugfix
release, it's always the same thing: release on a second Tuesday of
the month, three weeks before that the patches need to have settled,
everybody goes home with a dependable timeline.

Well, thanks, that's clear.

Personally I think we can try to follow that schedule, if possible. We
currently have a few patches waiting for months to be released, and
that's not because of the Git for Windows release schedule, but more
because the lack of call to action. Those easily can get out with the
GfW cadence.

I'm glad that you agree that Patch Tuesday isn't all _that_ much of a
friction point, this will allow some of my colleagues to relax visibly.

[...]

So I would like to suggest you and me collaborate closely to get a next
security release out and then we can go from there.

Excellent! Let's continue this conversation in a more private setting ;-)

Ciao,
Johannes