Security Issue Release process

Schedule

When picking a Wednesday for a release date, be sure to consider major holidays or times when people are unlikely to be working. Holidays or other events to avoid when scheduling a security release include:

• DrupalCons
• Thanksgiving in the USA (fourth Thursday in November).
• The end/beginning of the Gregorian year (i.e., around Christmas and New Year's)

Place, date and time

For Drupal security team members only, we coordinate in Slack:

• Place: #security (see “Using Security Team Chat” section for more details)
• Date: Advisories are released on most Wednesdays.
• Time: From 12:00 Americas/New York (UTC-5 or UTC-4 depending on daylight savings time)

Policy on committing fixes - the release window

It is ideal to coordinate with contrib maintainers to release SAs so that the commit, the creation of the release node, and publishing of the SA all happen within minutes of each other.
However it is often very difficult to get hold of maintainers on the day of the release. In order to make the coordination easier, maintainers should commit the fix up to 24 hours in advance of the release time.