release: v1.31.0-beta.2 - #1207
Merged
Merged
Conversation
A review of the whole 1.31.0 cycle, which is why this beta exists rather than waiting for the stable. Three findings let a checked-out project decide what ran on the machine that linked it, through values it commits in its own .lerd.yaml: a node_version reaching a worker unit's command line, a custom_workers entry's label, restart and schedule reaching lines of that unit, and a domains entry reaching the vhost's server_name where nginx accepted the result as valid. All three predate this cycle, so anyone on beta.1 or on 1.30.1 is exposed. Around those: the manifest that pins the downloaded tools is constrained to the hosts it may name and can carry a checksum, a sudoers drop-in is validated before it lands, composer stops reading as unknown on every install that already had it, and a project on a framework version older than any definition is no longer refused the PHP it actually requires. The beta.1 heading is replaced rather than appended, since only the stable gets a section of its own. The README picks up that the framework store now reaches back to the majors still running PHP 7.4, which ship from the store and need no release. The demo fixtures stay untouched and track the stable line.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A review of the whole 1.31.0 cycle, which is why this beta exists rather than waiting for the stable.
Three findings let a checked-out project decide what ran on the machine that linked it, through values it commits in its own
.lerd.yaml. Anode_versionreached the command line of a host worker unit. Acustom_workersentry'slabel,restartandscheduleeach reached a line of that unit, where only the command was ever checked, and systemd executed anExecStartPreone of them added. Adomainsentry reached the vhost'sserver_name, where nginx accepted the injected block as valid config and served it. All three predate this cycle, so anyone on beta.1 or on 1.30.1 is exposed, and that is the reason to take this beta rather than wait.Around those: the manifest pinning the downloaded tools is constrained to the hosts it may name and can carry a checksum, a sudoers drop-in is validated before it lands, composer stops reading as unknown on every install that already had it, and a project on a framework version older than any definition is no longer refused the PHP it actually requires.
The beta.1 heading is replaced in place rather than appended, since only the stable gets a section of its own. The README picks up that the framework store now reaches back to the majors still running PHP 7.4, which ship from the store and need no release. The demo fixtures stay untouched and track the stable line.
Verified on ubuntu26.04 and omarchy by upgrading in place the way
lerd updatedoes. Both migrated with no warnings, both sites still serve 302 to 200 with the real framework page, andlerd statusreports no failures on either. The three injections were re-run against this build on omarchy and none of them execute or serve.Two gaps worth naming. fedora43-2-clone and silverblue were not booted, so this is two of the four VMs rather than the full matrix. And the demo fixtures are deliberately stale, as above.