Best CRS branch for production

[Paul Beckett]

I'm looking to deploy CRS3 on an Apache 2.4x, mod-security 2.9.3 setup. I'd appreciate it if anyone could confirm the branch that is considered most suitable / recommended for a production install.

There seems to be a slight conflict in the advice between:

- https://modsecurity.org/crs/

- https://coreruleset.org/installation/

The former suggests the preferred method is to download from the githuib repository, which defaults to the 3.3/dev branch.

The later seems to advocate taking the 3.2 release (archive)

Could you confirm if for a reasonably conservative production environment, the 3.2 archive is the best option?

Thanks,

Paul

[Christian Folini]

Hello Paul,

CRS 3.2.0 is the latest stable release.

https://modsecurity.org/crs is not under the control of the project or
it would have been long updated.

Best,

Christian

> --
> You received this message because you are subscribed to the Google Groups "ModSecurity Core Rule Set project" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to modsecurity-core-rule-...@owasp.org.
> To view this discussion on the web visit https://groups.google.com/a/owasp.org/d/msgid/modsecurity-core-rule-set-project/f851187c-51ee-4fe2-98e8-3dc8b138fe46%40owasp.org.