Since Canonical released Ubuntu Pro this year, they are now withholding some security patches for many common packages, including some that are included on Laravel Forge provisioned servers.
I use AWS Inspector to monitor for vulnerabilities on my EC2 instances, and all of a sudden there are several medium-severity vulnerabilities that are unable to be patched with unattended-upgrades, or even a manual install. The patches are restricted to Ubuntu Pro users as part of the "ESM" service. This is not just true of older installations -- I have several vulnerabilities showing on 22.04.2 LTS builds, and I'm quickly approaching the SLA on resolving these for our SOC II protocol. This was never a problem in the past two years I've been using Forge + Ubuntu + AWS Inspector. All vulnerabilities were always patchable via unattended-upgrades or the occasional apt-get update/upgrade plus server reboot. I'm not really sure what the best course of action is -- but likely many enterprise Forge users will start feeling the effects of this soon. Perhaps there is another Unix distro that can be used, or maybe Forge can partner with Canonical to allow provisioning "Pro" servers at a reasonable cost?
Anyone else dealing with this now or have any ideas on how to best handle this situation?
universe
packages to security fixes/patches they've never had before, being a new feature that is now available & optional. Packages are still upgraded as before even without the Ubuntu PRO enabled, but only those provided by the community with no change (the new security patches are additional to the upstream packages previously available & still available with or without Ubuntu PRO enabled). Ubuntu PRO just means more flaws are searched for & thus fixed, instead of the traditional back-porting of fixes from upstream which hasn't changed !