Just a reminder, we're approximately 3 weeks away from the 90-day maximum embargo time to which we attempt to adhere. Taking into account a week for advance notification to downstream stakeholders that means we have at most a couple of weeks remaining, leaving us very little time for last-minute concerns that may arise with the proposed fixes.
At this point, it sounds like we still need the Cinder maintainers to decide for sure how they want to approach the risks described in this bug report. Also we'll want backported attachments for Glance and Nova as far back as their stable/2023.1 (antelope) branches. We'll also need to revisit the draft impact description to make sure the affected version numbers are still correct.
Just a reminder, we're approximately 3 weeks away from the 90-day maximum embargo time to which we attempt to adhere. Taking into account a week for advance notification to downstream stakeholders that means we have at most a couple of weeks remaining, leaving us very little time for last-minute concerns that may arise with the proposed fixes.
At this point, it sounds like we still need the Cinder maintainers to decide for sure how they want to approach the risks described in this bug report. Also we'll want backported attachments for Glance and Nova as far back as their stable/2023.1 (antelope) branches. We'll also need to revisit the draft impact description to make sure the affected version numbers are still correct.