After insalling 4.0.3 the default fedora template version is only version 30. This version reached EOL at 2020-05-26. IMO it might be a security problem using it for sys-firewall and sys-net.
I updated it to fedore 32.
But I see some issues with that:
If Fedore 32 is already released: why dont you make it the default after installing and updating 4.0.3?
You should at least give a hint about that on the installation guide.
I agree with this. New users will likely not be aware of this and thus run the risk of having an unpatched OS (which kind of is what people want to avoid be using Qubes).
I’d recommend you escalating this onto a formal issue report. But before you should always check if has already come up there before.
It is. However, for people coming from any non-security background this thing about having to follow update announcements may sounds a bit alien. But it’s always good to point that out