Hi, I'm just heavenly confused and try to get some answers regarding the current status of LimeSurvey. I try to keep it short so you do not need to read a wall of text.

1. I am running Limesurvey v2.71.1+170927 (CE), and suddenly get warnings regarding a required security update. Nothing unusual, so I checked the Download Section , and see there is only Limesurvey v3 available as stable release.

2. I try to get some information about the stable release of v3, but there is no news post on your news website regarding a stable release of v3. The latest news is still about the BETA Release of v3. So, is v3 stable at all?

3. My next step is: I try to find upgrade instructions (want to keep themes/designs), but according to the manual and to forum posts there is no update path available at the moment.


So I am maximum confused right now, maybe I completely missed something...

Are there security problems with v2.71? Have these security problems only been fixed with 3.x? Is 3.x considered stable for production (and can we import our old templates)? If we need to fix our v2.71 security problems by upgrading to v3, why is there no official upgrade path? Is there a v2.71 LTS Download with security fixes?

V3 has been released as stable before Christmas. However, as far as I know, it is / was not yet available for upgrade through the comfort update. The current Version of LS 3 is 3.1.

There are still a few bugs coming up here and then.

However, what is strange is that you don't get the information about the update to 2.73 which should be the latest version I think.

One other thing: The template system has changed once again completely, but hopefully now is stable. This means: You will not be able to import your old templates. You will have to great new templates based on the new template engine.

If you are currently running studies I would not update the production server just yet. Honestly, I would never update from a major version to another anyway. I would always make a parallel install, adapt the new system to my needs and when this is done, start with new studies on the new installation and slowly let the other installation run out until all studies are running on the new one. But that is just my approach and others might do it differently.

Holch, thank you for your quick reply. After your hint I found version 2.73 in the Archived Releases Section, and installed it manually. (We are never using comfort update for $reasons)

Since then I got rid of the security warning. So my mistake was, that I guessed I needed to update to 3.1 to solve my security problems, as I could not find a download option for 2.7x stable on the download page. So at the moment I am fine.

I fully understand the upgrade path you suggested, and it makes sense. We will contact our LimeSurvey Partner to update the themes we are using to be compatible to v3.1.

In the mean time... well, you did not mention any LTS Support for 2.7x. - do you know if there are going to be security updates for 2.7x for the next few months? We are willing to pay for this kind of support, like we already did back then for v2.06...

How does this

rom wrote: (We are never using comfort update for $reasons)

and this

We are willing to pay for this kind of support, like we already did back then for v2.06...

match?

I expect LS 3 to be the next LTS. But let's wait for an official comment.

Jelo, there are other ways to update limesurvey, without using comfort update. The 2.06LTS Version was also available as a ZIP File for paying customers, not only via comfort update.

You can always download the latest version as a ZIP file. As you can see, it is still there. It is just not advertised on the website, because the newest stable version is LS 3.

From what I can see, I don't think that 2.7x will have a long term support. Keeping more than one version up to date requires quite a bit of resources, so I think the team will probably avoid that as much as possible this time.

I also found the part with not getting comfort update for $$ reasons and then have a professional partner rather strange. Don't get me wrong, there is nothing wrong with it. LS is free and you can download it without costs. However, you seem to use it quite a bit from what I read (custom templates, professional LS partner), thus it feels like it would be great to give back to the project a bit. I feel that the comfort update is a good way to do so: It is reasonable priced (70-80 Euros per year) and it gives you a real benefit (Quick and simple updates). But anyway, this is not a requirement. Just thought to mention it.

So regarding LTS, I guess we have to wait for an official statement, but I wouldn't get my hopes up. LS 3 seems to be a lot more stable and usable at this point than LS 2.5x at the same point in time back then. So I personally assume focus will be 100% on LS 3 to get this completely stable asap. But I don't have any insights on that at the moment.

Thanks for your extensive reply, holch.

So what I get from your reply is, that it is indeed very possible that if a huge security issue might appear in the next few weeks, the only option for Limesurvey 2.7 users to fix that security hole is to upgrade to v3.1, as v2.7 will not get any further security fixes. This means all v2.7 users have now to hurry up to get their templates/modifications ready for an upgrade, and should upgrade in their production environment to v3.1 asap to receive further security updates.

Waiting for an official statement sounds strange to me, as v3.1 is already advertised as stable. So IF there is some kind of extended support for 2.7 there should have been an official statement already imho?

Regarding our approach to comfort update (totally offtopic): I am afraid you got me wrong here, we do not care about these few Euros ($reasons = php variable, not Dollar) and would be happy to give something back to the community/developers. We already donate some money when our reported Bugs get fixed, we payed for 2.06LTS and so on, so money is not an issue here. We are using the professional partner solely to design our template files, but we have no use for comfort update as we need to modify/add some code to Limesurvey with every update. We need some special text strings, so we modify the language files. We are doing these modifications since v1.x, and even created an updater bash script to automate the update process and implementing our modifications. In the past we already had some discussions with the limesurvey developers (Denis) and also opened up a feature request long time ago, but we had no luck so far.

rom wrote: So what I get from your reply is, that it is indeed very possible that if a huge security issue might appear in the next few weeks, the only option for Limesurvey 2.7 users to fix that security hole is to upgrade to v3.1, as v2.7 will not get any further security fixes. This means all v2.7 users have now to hurry up to get their templates/modifications ready for an upgrade, and should upgrade in their production environment to v3.1 asap to receive further security updates.

No, that is not what I said.

First of all, I want to stress that I currently have no insights on the strategy of the developer team regarding 2.7x. This is all my own opinion and impression.

Second, despite my expectations that 2.7x will not turn into a LTS version, I believe that if there would be a "huge security issue" with 2.7x in the next weeks that those issues most probably would be fixed (however, if they didn't come up now, I don't expect them to come up in the next few weeks). But I would not expect any minor bugs to be fixed anymore.

Waiting for an official statement sounds strange to me, as v3.1 is already advertised as stable. So IF there is some kind of extended support for 2.7 there should have been an official statement already imho?

This is speculation. So far there was no official statement on how the developer team will handle 2.7x in the future. But the LTS for 2.06 was rather a reaction to the problems with 2.5x at the beginning than a previously planned thing. While I personally wouldn't consider LS 3 completely stable just yet, it doesn't have the same level of problems than LS 2.5x had when it first got released as a "stable" version. So I don't think that the developers see it a necessity to keep 2.7x running for much longer. Unfortunately the communication is sometimes a little flawed. LS 3 has been released silently. I assume to get some early adopters to run it and report bugs. It was not offered at the beginning for comfort update. They seemed to work on this. I expect, once it is pushed out via Comfort Update, that there will also be an official statement about the EOS (or not) of 2.7x. Until then, there is only speculation. But you could always just try to get in touch with the Limesurvey GmbH via "Support" and ask for the plans for 2.7x. Or you are lucky and someone of the Limesurvey GmbH will show up here.

Regarding our approach to comfort update (totally offtopic): I am afraid you got me wrong here, we do not care about these few Euros ($reasons = php variable, not Dollar) and would be happy to give something back to the community/developers. We already donate some money when our reported Bugs get fixed, we payed for 2.06LTS and so on, so money is not an issue here. We are using the professional partner solely to design our template files, but we have no use for comfort update as we need to modify/add some code to Limesurvey with every update. We need some special text strings, so we modify the language files. We are doing these modifications since v1.x, and even created an updater bash script to automate the update process and implementing our modifications. In the past we already had some discussions with the limesurvey developers (Denis) and also opened up a feature request long time ago, but we had no luck so far.

Then I really got you wrong there. I (and obviously also Jelo) read "$reasons" as "Dollar reasons" or "Money reasons".

Thanks holch, for being so patient and for taking your time to answer my questions. Sorry for the misunderstanding, English is not my mother tongue. :S

I will keep an eye out for official statements from the development team on the News Page, and hope that there will not appear any security related issue in the next few weeks with 2.7. I agree with you, especially from an outside perspective, the official communication from the development team regarding LSv3 is looking like it's quite flawed. Thank you for trying your best to clear this up, much appreciated.

I updated to LS 3 and had to put mine back to 2.67 because I could not get things to work in version 3. I'd wait a while for a more stable version.

Kevin wrote: I updated to LS 3 and had to put mine back to 2.67 because I could not get things to work in version 3. I'd wait a while for a more stable version.

Depending on thing that didn't work you might can wait forever. Themes and many workarounds won't will work after upgrading.

Why did you get back to 2.67 and not to 2.73 which is the latest version of the 2.7x branch of LS?

One other thing: Just as Jelo says, depending on what "did not work" for you, you might not getting it working, as this is a different version with a new theme engine.

And: If you don't report the bugs you encountered, they might not get fixed. So ideally you at least test 3.0 in a parallel installation and give feedback to help make 3.x better.