Back to this: > please avoid 5.4.3.16 for now. What is the current stable / version of 5.4 then? the filtering on DockerHub is hindered by all the SNAPSHOT releases up there, I can't clearly see a version after 5.4.3.16 that isn't just a SNAPSHOT or an RC Being more techo (thanks copilot):

curl -s <https://hub.docker.com/v2/repositories/lucee/lucee/tags/?page_size=10000> | jq -r '."results"[]["name"]' | grep -E "5\.4\.[0-9]+\.[0-9]+-nginx$"

Suggests 5.4.3.16 is still the latest "stable" version. But... actually not stable and is supposed to be avoided (so I question why it's up there at all??)

any resolution to this?

Apparently it was too complicated a question to answer.

its wild. i can't believe 6 is marked latest without any announcement or fanfare. i could care less about 6. I just want a version without a vulnerability target on it.

bump 🙏

👀

bump 🙏

Hello? Is this really that complicated a question for someone on the project to answer? My InfoSec bod is going "WTaF, Cameron?"

Perhaps posting your question on the Lucee dev forum itself will get their eyes on it? Really not sure what the problem is here. 100% agree, that version should never have been posted under stable if it isn't.

Oh yeah good idea.

FWIW I found this one posted over there which also has no answers. The mystery around version 5.4.3.16 thickens... https://dev.lucee.org/t/lucee-5-4-3-16-release-no-changelog-whats-new/13139

Oh I didn't see that. I've reposted my query there as https://dev.lucee.org/t/clarification-about-5-4-3-16-sought/13257

Did you see 5.4.4.38 is now available in the Lucee downloads: https://download.lucee.org/?releases=05.004.004.0038.100#core

I don't see much in the 5.4.4.38 changelog. The mystery continues.

See response from micha on that thread

Micha:

The latest version of Lucee 5 is 5.4.4.38. To my knowledge, there are no known major issues with version 5.4.3.16. It’s important to note that version 5.4.3.15 had a regression issue, which led to the release of 5.4.3.16. Both 5.4.3.16 and 5.4.4.38 are stable and safe for use. Lucee 5 now is in LTS mode, means it only get important, security and regression fixes, all done as conservative as possible.

My reply:

Thank-you. Sincerely.

So for the sake of those of us with rigid (and semi-regulated) IT policies, can there be a release of 5.4.4.38 made without the word “snapshot” in it? Ooh, actually… there’s no Docker image of 5.4.4.38 (of any variant) at all on Docker Hub…?

And it was a comms error about 5.4.3.16 being something to avoid? It’s hard to tell as it has no release notes (according to someone else… I did not check).

Thanks again.

@micha @zackster 💪

My InfoSec bod is happy about this. Now... all our unit tests pass on the new build, but our coverage is not great so whilst this is a good start... I'll report back more once QA has been at it...

@Adam Cameron -- my tests have been coming back clean too. Coverage is weak outside areas I use regularly, but it is looking promising 🙂