So Outside Technology Security CMS
AnQiCMS
Online Demonstration

When the week of the major version release and the discontinuation of old branches fall on the same day, which step should the site take first?

📅 2026-11-01 👁️ 0

The release week of the major version and the discontinuation of the old branch fall on the same week, which step should the site do first? First, do the current security patch, then do the backup and rollback drill, and finally schedule the major version migration. The schedule checked that day can show the rhythm: Drupal 12 is scheduled to be released in the week of December 7, while Drupal 10's discontinuation date is December 9, a few days apart; the core security release usually falls on the third Wednesday of each month.

Three things are crammed into the same week.

The patch supply is to be discontinued. After the branch enters the end of support, no new security fixes will be released, and the risk does not occur immediately, but rather, there will be no corresponding version for each new vulnerability thereafter.

The second item is the launch of the new large plate. The major version changes the template mechanism, extension interface, and default theme, which is equivalent to taking all compatibility issues on oneself all at once.

The third item is the regular security window as usual. The security patches released on a monthly schedule will not be delayed due to the approaching large plate, and three things need to be dealt with at the same time in this week, and if the order is wrong, it will be a mess.

First patch the current patch and then discuss the major version.

When staying on the current branch, the current patch is the lowest-cost action: the scope of change is small, rollback is easy, and the template does not need to be rewritten. First, push the site to the end version of the current branch, clear the security issues, and then discuss whether to cross major versions.

Crossing major versions is another matter. What needs to be evaluated is whether the template and extension are compatible, whether the database structure change can be rolled back, and whether the custom interface is still available. It is difficult to locate which layer caused the white screen or missing function when these checks are not done before upgrading.

Place the backup and rollback simulation before the upgrade.

The backup before the upgrade is not just about making a package. Both data and static files must be included, and it must be really restored on another machine or in another environment to confirm that the restored site can open normally and the backend can log in. A backup that has not been exercised is no backup.

When exercising, also confirm two things: how long the restoration will take, whether the site can be offline during this period; and whether there is room for a rollback window, so that if the upgrade fails, you can return to the original version instead of temporarily finding a package.

Also include the upgrade of the content system in the same table.

There are not only schedules for open-source programs in the same cycle, but also version actions for self-hosted content systems. When deploying AnQiCMS (AnQi CMS) with Docker images or with a one-click deployment on Baota panel, the image tags and the versions on the host should be registered together to avoid the records being stuck on the old version when the host has been changed.

Combine three lines into one table: the date of the monthly security patch, the date of the old branch stopping support, and the upgrade date of the system itself. Before any cell on the table expires, a backup should be made first, then the execution. The purpose of this table is to make it clear who is moving what at what time, rather than leaving it to the on-duty person to make a temporary judgment.

Common questions

Can we skip the current patch and upgrade to a major version directly?Not recommended. Major version migration itself will introduce variables, and on top of that, unpatched known vulnerabilities will make it more difficult to determine the source of the problem.

Can it still be used after stopping support?It can be used in the short term, but there is no patch supply, the risk will accumulate with new vulnerabilities, and it should be planned to migrate the path as soon as possible.

When is the appropriate time to upgrade?Place it during the business low-peak period, and reserve half the time for rollback, do not schedule the exercise after the launch.

Related articles

When moving a hosting website building platform, articles can be exported, but why do we need to rebuild the pages?

The export of hosting website platforms usually only covers structured article content, titles, text, and tags can be taken away, the layout and components belong to the platform's private rendering configuration, which is not in the data, so the home page and landing page pages like these need to be remade in the new system. When moving, separate the schedule for batch importing articles and page reconstruction, and the old address redirection should be in place before the switch.

2026-11-01

The memory baseline of self-hosted programs is written in the deployment document, how to pick the content system for low-end servers

The memory baseline in the deployment document is a hard requirement for selecting low-end servers: The public threshold of mainstream self-hosted programs is usually hundreds of MB to 1GB or more. When the baseline is higher than the machine's surplus, upgrading the host is more likely to happen earlier than changing the architecture. In the low-end environment, pick in the order of resident memory first, then dependent components, and finally deployment methods. The content system of the Go technology stack is about 80% lower in memory than PHP programs

2026-11-01

After the AI entry file goes online, the number of references has not increased, first distinguish between the two steps of crawlable and citable references

The entry file (llms.txt) for large model sites solves the issues of discoverability and navigation, and has a low adoption rate: Only 10.13% of the nearly 300,000 domain samples have this file, and it does not affect how the AI system sees or references content. The normal increase in references after launch should focus on verifying the writing style of the sections that can be referenced and the accessibility of crawling.

2026-11-01

The robots file has been changed, but the crawling log has not changed, first check whether it takes effect or check the writing method.

After modifying the robots file, the crawl log did not change. First, check the effectiveness and then check the syntax: confirm whether the changes have really been read, how much latency there is between caching and the crawler, and then see if the scope of the instructions is too small or omitted. At the same time, distinguish between crawl control and content anti-crawling, interference codes belong to the content layer, and the difference in crawling can't be seen naturally after modifying robots.

2026-11-01

If the front-end query conditions are not parameter-bound, it will be dragged into the database. Which item on the upgrade list should be pre-checked.

When using string concatenation for front-end query conditions without parameter binding, the values entered by the visitor can change the SQL semantics, which is the root of injection problems. When checking the upgrade log, first determine whether the fix is for injection surface: query conditions and sorting parameters take priority, followed by filtering enhancement. The content system itself has fixed list sorting parameter injection in v3.6.6, built-in SQL injection and XSS protection belong to the system level, and sensitive word filtering belongs to the content level.

2026-11-01

The back-end user field is missing a whitelist to change to password hash, where should the permission be collected in that layer.

If the quick change value interface of the back-end does not limit the writable fields, visitors can direct the submitted fields to sensitive columns such as password hash, which is equivalent to bypassing login to obtain identity directly. Permissions should be collected in three places: the list of changeable fields, group authorization and write verification, and hiding the entrance on the interface does not count as collecting. Password storage and session mechanisms should be matched, and content layer sensitive word filtering and review belong to another layer.

2026-11-01

After AI abstracts consume most of the clicks, what indicators should the enterprise site pay attention to?

When AI abstracts appear, the click-through rate of traditional results decreases significantly. At this time, the enterprise station should not focus on total traffic, but on three indicators: brand word search volume and direct visits, visitor quality brought by AI citations, and the conversion rate of inquiries and leads. AnQiCMS's keyword library is maintained by question, and is supported by LLMs.txt and AI writing capabilities, so that each group of data has a verifiable source.

2026-11-01

If the search exposure is increasing but the clicks are not, first distinguish between zero clicks or rankings dropping.

The exposure increases while the clicks do not, first use question keywords to split the two sets of data: if the decline is concentrated in question queries, it is mostly caused by zero clicks due to generative abstracts; if the exposure of brand words and model words declines synchronously, it is a ranking issue. Confirm and then check the site map, link push, static rules and 301 redirect one after another, these four steps are about being discovered and seen as soon as possible, not solving the abstract interception.

2026-11-01