Monthly Patching and Weekly Security Patching

[Chuck Nusbaum]

The new weekly security patching is throwing me for a bit of a loop with respect to monthly patching. Here's the scenario.

At the beginning of August, we decided we wanted to go to Zurich Patch 11m to fix a known issue. We upgraded non-prod instances to 11m and scheduled prod to go to 11m as well at the end of the month.

In the middle of the month, weekly security patches started being deployed, and 11m was determined to be a downgrade from Patch 10 Hotfix 4 w33, so our prod update to 11m got canceled.

Today, we got notification of the October patching target: Zurich Patch 10 Hotfix 4b.

I'd like to get our instances on the same patch level again...but I suspect that if we schedule to go to Patch 12, then weekly security patches are going to determine it as a downgrade and it will be canceled again.

Shall we just give that a try or does anyone have a different/better approach?

[AutomatePro]

These are super helpful links Kristin thank you.

There was a lot of discussion about this on a webinar we hosted with NowBen yesterday.  Some platform owners were not aware of the weekly security patches and others are struggling with how to validate them at the weekend when there is no support team in place to deal with issues.

Some of our customers are scheduling full automated regression tests to run after the patch is installed on a sub-prod instance, which at least gives some time to review the test results and request to pause the prod install (which apparently you can do with approval from ServiceNow).  They can use the before and after test results comparison report and screenshots to provide the evidence to ServiceNow that the patch has broken their instance, which substantiates the request to delay the prod install.

[Chuck Nusbaum]

Thanks, y'all!

Kristin, I've read through those two KBs so many times my head is spinning. 🙂 I find them quite confusing as well. I'm sure they continue to be updated with additional details as ServiceNow is figuring things out (I just subscribed to keep more on top of them).

Oddly, I hadn't seen our subprods on Z11m get any weekly security hotfixes all of August, unlike Prod on ZP10HF4a which received weekly security hotfixes every week. (As an aside, weekly security hotfixes and patch hotfixes...it's even more confusion with what things are being called.)

We're going to see what happens this weekend when our Dev instance should go to ZP12 and, presumably, Prod will get another weekly security hotfix. Will our Prod CHG to go to ZP12 later this month get canceled again? Tune in next week for the next installment! 😉

[Chuck Nusbaum]

As you expected, @AutomatePro, the CHG we scheduled to update Prod to ZP12 was canceled for being a downgrade from the weekly security hotfix.

Our plan at this point is, on Monday, 9/21, to schedule a CHG to update Prod to the latest weekly security hotfix version of Zurich Patch 12 on Friday, 9/25. That CHG should not get canceled because the weekly security hotfix won't have applied yet. We'll see if that works!