There is a week since Drupal 6.30 is released to fix some XSS vulnerability, but Pressflow is still on 6.29.

I am wondering if it is discontinued. If so, are there any new forks that up to date?

  • 3
    Really, its last update was 2 months ago on Github ... and you think its been discontinued? If you want the merge done faster, do it yourself and push or submit a patch to the github project. – tenken Jan 22 '14 at 19:29
  • I wish I could contribute but I'm not a developer. As I see on github there are many people who are bumping for update. There is a security risk involved! – alfish Jan 22 '14 at 19:43
  • 3
    Simply be patient, sorry its Open Source; people are working essentially for free to benefit you. There are some security risks but there are caveats too all the listed security risks and they may or may not affect your Drupal website depending on the Modules you have enabled. – tenken Jan 22 '14 at 20:33
  • 1
    @alfish I remove my answer, as it was wrong. I suggest reading the new one. – mpdonadio Feb 10 '14 at 17:26

There are a few questions here:

What was the timeline of events for the 6.30 release of core and Pressflow?

Why isn't there news about Pressflow 6?

Well, it depends on where you want to go to get news and what your expectation is. Drupal 6 and Pressflow 6 are pretty slow in terms of news. They are stable except for these security updates. I think it's reasonable that the promotion/updates about it are minimal beyond what is necessary for development. If you want to know what's going on (including the sate of the last release) check the issues and pull requests. And if you went there on January 15th you'd see a pull request that you could try out to get the security update and help in the process of releasing the next version by providing a review.

Will there be timely updates moving forward?

Peter Wolanin (and Gabor Hojtsy, I'm told) are now able to commit changes to the Pressflow repository on github. It seems likely that they are interested in Pressflow because many of the users of Pressflow are clients of Acquias. Peter and Gabor are both Security Team members (and Gabor a D6 maintainer) who stay aware of the core security releases. So, I think it's safe to say that updates will flow more quickly in the future.


No, it is still being kept up to date, but it will always take a few days after an official Drupal core release before Pressflow is updated as they are making sure that new changes don't interfere with the Pressflow code in core. From the FAQ:

When there is a new version of Drupal, does Pressflow also get updated?

"Yes! All patches and security updates provided for both Drupal 6 and 7 are also be applied to Pressflow 6 and 7. We will release updates to Pressflow in a few days after they are available on Drupal.org."

  • 1
    well it is worrisome become previously they used to add updates in 1-2 days. Now there is no news that they even working on it. – alfish Jan 22 '14 at 19:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.