docs(dnn): #131 errata banner on #511 plan-v2 — CVE table superseded by #520 - #528
Merged
Merged
Conversation
#520 The merged #511 sandbox plan-v2 states (§2 table, §1 title, §7 Step 1) that 9.13.x closes CVE-2025-64095 and is a "security palier" closing 1 of 2 critical CVEs. The follow-up corrigendum #520 (merged) corrected this — grounded in NVD + official DNN GitHub Security Advisories: - CVE-2025-64095 first patched in 10.1.1 (not 9.13.x) - CVE-2025-52488 first patched in 10.0.1 - the 9.13.x line closes NEITHER (0 of 2), target = 10.1.2 #520 documents the error but #511 itself was never updated, so a reader hitting #511 §2 still sees the dangerously wrong "9.13.x closes 64095" claim (could lead to believing a 9.13.x hop is a security step). Minimal history-faithful fix: add an ERRATA banner at the top of #511 pointing to #520 as source of truth + #527 for the go-live procedure, explicitly retracting §2 + the "1 of 2" framing while retaining the still-valid runtime finding (§3: DNN 10 = .NET Framework 4.8) and 2sxc compatibility matrix (§5-6). Doc-only hygiene (idle-light coherence pass on the DNN doc arc). No content rewrite of merged history, no target change, no prod mutation. Refs #131 #520 #522 #527. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
clusterManager-Myia
left a comment
clusterManager-Myia
left a comment
Collaborator
There was a problem hiding this comment.
[NanoClaw]
LGTM — coherence pass catching a real cross-document safety contradiction in the DNN doc arc. 0 execution_count changes, 0 secrets. Good catch on sandbox plan-v2 reference surviving after merge.
This was referenced Jun 18, 2026
jsboige
added a commit
that referenced
this pull request
Jun 18, 2026
…5→≥21 (jsboige decision #2) (#531) jsboige interactive decision #2 (issue #458, 2026-06-18): "Je suis pour l'upgrade complète, même si c'est plus lourde" → target = 10.3.2-latest + 2sxc 15→≥21 + template audit. Supersedes the 10.1.2 target of #520/#522/ #527/#528. #445 Stripe Native unblocked (OpenStore blocker dissolved). Net-new decision-spec (131-target-revision-10.3.2-full-upgrade.md, +141): - The 6-phase go-live procedure (#527) + rollback contract + .NET 4.8 runtime finding remain valid; only target + 2sxc scope change. - 2sxc upgrade path: 15.02 → 21.07 LTS on DNN 9.11.1 (2sxc-first), then DNN → 10.3.2. Adds new Phase 1.5 + expanded Phase 3/4 (content migration is now real, unlike the 10.1.2 no-op). - KEY GROUNDED FINDING (§3): the template audit is largely ALREADY DONE. All 4 Argumentum custom templates already use @inherits Custom.Hybrid.Razor14 (verified, not asserted) — the legacy RazorComponent migration #131 flagged is complete. APIs in use (App.Query, AsList, CmsContext, Link.To, Edit.TagToolbar) all maintained in 2sxc 21. Residual risk is the 25 stock apps' v20 infra changes (staging-test item, not repo-audit). Superseded banners added to the 4 target-bearing runbooks pointing to the new decision-spec as source of truth (#520, #522, #527 §4 "no 2sxc migration" explicitly invalidated, #511 errata redirected). No merged history rewritten. Doc-only, non-gated. Execution (deploy/upgrade/2sxc) stays GATED jsboige. No prod mutation, no DB/RDP, no template edit. Refs #131 #458 #445 #514 #520 #522 #527 #528. Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Idle-light coherence pass on the DNN doc arc found a real cross-document safety contradiction. The merged #511 (sandbox plan-v2) still states — in its §2 CVE table, §1 title staircase, and §7 Step 1 — that 9.13.x closes CVE-2025-64095 and is a "security palier" closing 1 of 2 critical CVEs. The follow-up corrigendum #520 (merged) corrected this with authoritative sources, but #511 itself was never updated, so a reader hitting #511 still sees the wrong claim.
The error (per #520, grounded in NVD + official DNN GHSA)
The risk: a reader could believe a 9.13.x hop is a security step.
Fix — minimal, history-faithful errata banner
Added a top-of-document ERRATA banner pointing to #520 as source of truth + #527 for the go-live procedure, explicitly retracting §2 and the "1 of 2" framing. The doc's still-valid parts (§3 runtime finding: DNN 10 = .NET Framework 4.8; §5-6 2sxc compatibility matrix) are explicitly retained.
This matches #520's own "read-before-action" discipline — it does not rewrite #511's merged history, just ensures no one acts on the superseded CVE claim.
Doc-only hygiene, non-gated
docs/dnn-localization/131-upgrade-sandbox-plan-v2.md).7a07abc9.Refs #131 #520 #522 #527.