Would KEDA be open to doing patch updates after Dependabot commits?

[qpetraroia]

I noticed that Dependabot is enabled on the repository. It would be beneficial to have more patch releases that cover Dependabot updates. Would the community be open to more releases addressing these dependency updates? I believe this would be a great way to release patch updates that cover vulnerabilities that Dependabot finds.

[zroubalik]

Unfortunately we don't have a bandwith to do more releases off-cycle, we usually od 0-2 off-cycle release if there are some critical bugs in the codebase.

[qpetraroia]

Is there usually a timeline between releases? Does KEDA have a CVE policy as well? Thanks @zroubalik

[zroubalik]

Please see our roadmap for details: https://github.com/kedacore/keda/blob/main/ROADMAP.md

[davogen]

I am also interested in this.

[davogen]

@qpetraroia FYI I have found this on the KEDA website on the Support page: https://keda.sh/support/#commercial-support

I wonder if these vendors provide patch releases. We have a strict CVE and security policy at our company, so this might be a solution.