Two weeks ago, Drupal released 6.23 to fix a security vulnerabilities, which was followed from Drupal 6.24. However, Pressflow is still in 6.22 (although, there are some files have been changed at the last week).
I am wondering whether Pressflow 6.22 has not been affected by the vulnerabilities in Drupal 6.22, or it does but it takes time for the team to upgrade it. If so, how insecure is Pressflow 6.22?
They only merged in the parts of Drupal that changed for the security update. See https://github.com/pressflow/6/blob/master/modules/system/system.module.
/**
* The current system version.
*/
define('VERSION', '6.23');
I'm a developer at Four Kitchens.
Drupal 6.24 introduced changes to the bootstrap process, and those created a merge conflict with Pressflow. See David Strauss' comments here on Github.
The forks of Pressflow on Github may have the latest 6.24 but these changes have not been reviewed by Pressflow maintainers and no pull requests have been sent.
The forks also include patches from the Drupal issue queue to fix some serious issues that appeared in 6.24, and they are not the most recent patches in the actual issue nodes:
So beware: Using a fork means you're using Pressflow upgraded to 6.x-dev essentially, except it's not even -dev as these issues are not yet adequately resolved; at least, not sufficiently enough to be accepted into Drupal 6.x-dev.
We're working on getting a full 6.24 stable version of Pressflow out. In the meantime, Pressflow 6.23 contains the security fix and was available when Drupal 6.23 was released.
You can also follow Pressflow at https://twitter.com/#!/pressflow.
https://github.com/pressflow/6
If you want 6.24 try https://github.com/omega8cc/pressflow6. See http://groups.drupal.org/node/187209 for some of the extras included in this fork of pressflow.
