Skip to content

Commit 00ff863

Browse files
aclark4lifeCopilot
andcommitted
Remove section 7.5 Rollback Procedures
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
1 parent e74a89f commit 00ff863

File tree

1 file changed

+3
-19
lines changed

1 file changed

+3
-19
lines changed

.github/INCIDENT_RESPONSE.md

Lines changed: 3 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -168,23 +168,7 @@ For Critical and High severity where distro pre-notification improves user safet
168168
- Publish the GitHub Security Advisory.
169169
- Announce on [Mastodon](https://fosstodon.org/@pillow).
170170

171-
### 7.5 Rollback Procedures
172-
173-
If a security patch introduces a critical regression after release:
174-
175-
1. **Yank the release immediately** via the PyPI web interface:
176-
[https://pypi.org/manage/project/pillow/](https://pypi.org/manage/project/pillow/)
177-
(navigate to the release, click **"Yank"**).
178-
Yanked releases remain downloadable by pinned users but are excluded from `pip install`
179-
resolution, giving time to fix without leaving users unpatched.
180-
2. Post a public notice in the GitHub release and on Mastodon explaining the regression and
181-
that the release has been yanked.
182-
3. If the previous (vulnerable) version was also yanked, **un-yank it temporarily** so users
183-
have a functional fallback while the corrected release is prepared.
184-
4. Prepare a corrected point release (incrementing the patch version), repeating sections 7.2–7.3.
185-
5. Document the regression in the post-incident review (Section 9).
186-
187-
### 7.6 Supply-Chain / Infrastructure Compromise
171+
### 7.5 Supply-Chain / Infrastructure Compromise
188172

189173
1. **Immediately** revoke any potentially compromised credentials:
190174
- PyPI API tokens (regenerate and update in GitHub secrets)
@@ -199,12 +183,12 @@ If a security patch introduces a critical regression after release:
199183
4. Notify GitHub Security if repository access or Actions secrets are involved.
200184
5. Issue a public advisory describing the scope and any user action required.
201185

202-
### 7.7 Recovery
186+
### 7.6 Recovery
203187

204188
After the fix is released and the advisory is public:
205189

206190
1. Verify that the patched wheels are live on PyPI and passing CI across all supported platforms.
207-
2. Confirm any yanked releases are handled correctly (re-yank if un-yanked as a fallback during rollback).
191+
2. Confirm any yanked releases are handled correctly .
208192
3. Resume normal development operations on `main`.
209193
4. Monitor the GitHub issue tracker and Mastodon for user reports of residual problems for at least **72 hours** post-release.
210194
5. Close the private GitHub Security Advisory once recovery is confirmed.

0 commit comments

Comments
 (0)