A security patch for openedx/edx-platform will be added to the Ulmo and Verawood releases and to the current github master branch around 2026-07-07T14:00:00Z.
It will fix one security defect with a “high” CVSS 3.1 severity rating.
Details will be published here after release: GitHub security advisory
The fix has been merged and the advisory is now published.
Will there be an updated version of tutor for that ?
There were no changes to tutor itself so you should be able to re-build images and re-deploy to get the fixes. Assuming you don’t have a custom fork of the openedx-platform repository that you’re using.
If you do have a custom branch/fork of the repo, you’ll need to pull the latest fix commits from the head of the relevant release branch onto your release branch.
I see. I thought a given version of tutor built a reproducible version of edx (i.e. with the same bugs).
I believe that’s true if the platform revision is set to the tag which is the default. But you can set the revision to the branch and get the updates more quickly.
The thing I said earlier was a bit misleading. If you don’t do anything with a released version of tutor, you get the security fixes by updating tutor and re-deploying. This causes tutor to re-build the images cherry-picking any fixes that tutor has listed.
What I was trying to say was, you can also just set your revision of the platform to the named release which does mean it could change underneath you but will only change when there are security or other major fixes to the release.