LoginSign Up
← Back to all sparks
S

SimpleSAMLphp

DEVOPS
Velocity5.0

SAML identity and service provider implementation in PHP

simplesamlphp.org ↗

SimpleSAMLphp patches both maintenance branches again, with no word on what was fixed

samlidentitysecurity-releasesmaintenancedual-branch
◆Current state
SimpleSAMLphp maintains parallel 2.4 and 2.5 branches and patches both when a fix lands. On 9 November it released 2.5.4 and 2.4.11 minutes apart, both labelled security releases, after a quiet two months since the 2.4.10 bugfix in August. As before, the release bodies point to the changelog and upgrade notes but describe nothing themselves.
◆Where it's heading
Security fixes keep arriving as paired drops across both branches, which means 2.4 is still supported. The feed tells operators when to patch but never what was exposed.
◆Prediction
Further fixes will likely ship as paired 2.4/2.5 releases again; when 2.4 support ends is not visible in these entries.

◆Recent moves

  1. 4d ago

    2.4.11 security release on the older maintenance branch

    The 2.4 half of the 9 November security drop, released minutes after 2.5.4. It confirms 2.4 still gets security fixes, though the notes don't say what was fixed.

    View source ↗
  2. 4d ago

    2.5.4 security release on the current branch

    The first 2.5 release since the re-tagged 2.5.3.1 in August, flagged as a security release. Identity-provider operators should patch, and check the external changelog for details.

    View source ↗
  3. 2mo ago

    Bugfix release on the 2.4 maintenance branch

    A bugfix point release on the older 2.4 branch, arriving three weeks after the 2.5 security drop with the same checksum-only body. It keeps the legacy branch current for sites that have not moved to 2.5, and describes nothing user-visible.

    View source ↗
  4. 3mo ago

    Security release on the 2.5 branch (re-tagged)

    A security release on the 2.5 branch, tagged v2.5.3.1 roughly seven hours after the v2.5.3 tag with different checksums — a re-tag of the same release rather than a second fix. Operators need to patch, but the body documents nothing beyond hashes.

    View source ↗
  5. 3mo ago

    Security release on the 2.5 branch

    The original v2.5.3 security tag, twinned with the v2.5.3.1 re-tag later the same day. Same maintenance rhythm as the rest of the feed: patch now, read the external changelog to find out why.

    View source ↗
  6. 3mo ago

    Bugfix release on the 2.4 maintenance branch

    A bugfix point release on the older 2.4 branch, landing a day before the 2.5 security drop. Nothing user-visible is described — it keeps the legacy branch current for sites that have not moved to 2.5.

    View source ↗