Missing container invalidation update from issue modifying services

Yup, same here

This is critical since SA-CONTRIB-2024-039 advises upgrading to 2.0.3, which makes the site inaccessible.

Seckit should have implemented an empty postupdate as a part of 📌 Fix validate pipeline Fixed . This is the Drupal convention to force container invalidation.

Alternatively, you can just clear the cache before running deploy.

If someone wants to action that here, you can do that. An example can be found in Drupal core v10 series @ `big_pipe_post_update_html5_placeholders`, and many others over time.

Changing severity, since there is a clear workaround and should be automatic if you are using the standard `drush deploy`.

I just created another issue and MR which touches on services, which needs a postupdate hook.

Instead of something here, maintainers can consider merging that instead, which will fix up container for this issue.

Thanks for explaining this, @dpi. The steps you outlined resolve the problem for me.

The changes from the issue don't apply to the 2.0.3 version.
Switching to 2.x-dev fixed the error

ArgumentCountError: Too few arguments to function Drupal\seckit\EventSubscriber\SecKitEventSubscriber::__construct(), 2 passed in /var/www/html/docroot/core/lib/Drupal/Component/DependencyInjection/Container.php on line 261 and exactly 3 expected in Drupal\seckit\EventSubscriber\SecKitEventSubscriber->__construct() (line 70 of modules/contrib/seckit/src/EventSubscriber/SecKitEventSubscriber.php).