Create new stable release for 6.2.3 to close security issue

This would be helpful. We have seen some issues reported recently that look like they can be traced back to the polyfill.io service. While the patch/MR works for us, a new release would make it easier to update.

Yep, this can happen in the next day or so. I will review open tickets to see if anything else should go into the release

Shall I make an RC now?

You can make an RC, but I need to tag a stable one this week. We could skip the RC

I was about to make an RC, but tests are not passing.

Webform 6.2.3 → released.

Thanks again for the swift response guys!

Shouldn't this release be tagged as a security update?

I thought that was only for releases which were released in coordination with the security team. This issue has been public for ages.

Users are more likely to update the module if the release says "Security". As far as I know, security releases can also include issues fixed in the public issue queue, or issues related to 3rd party libraries, such as for this PSA

To me, it looks like its up to the maintainers. https://www.drupal.org/drupal-security-team/security-release-numbers-and... →

@solideogloria according to this: https://www.drupal.org/docs/develop/git/git-for-drupal-project-maintaine... → , each "Security update" release type should be linked to the correspoding SA. There are no SAs for these polyfill.io issues, see: https://www.drupal.org/psa-2024-06-26 → . Therefore I think that we should not use a Security update release type here.