{"thread":{"id":"48548","subject":"Officially supported Git versions","startedAt":"2018-05-22T17:29:55Z","lastAt":"2018-05-23T03:16:43Z","messageCount":2,"participants":["Patrick Lühne","Junio C Hamano"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"348312","messageId":"b5856696-bfcf-173a-49ac-6aa6989316d3@luehne.de","threadId":"48548","inReplyTo":null,"subject":"Officially supported Git versions","fromName":"Patrick Lühne","fromEmail":"patrick@luehne.de","sentAt":"2018-05-22T17:20:01Z","receivedAt":"2018-05-22T17:29:55Z","isPatch":false,"sender":{"key":"patrick@luehne.de","avatar":null},"body":"Hi,\n\nIs there an official list of the Git versions that are still actively\nsupported? According to hearsay from colleagues, the latest five release\nseries receive security patches. I can’t find a source for that, but\nmight that be correct?\n\nThere’s also the Wikipedia page on Git [1], but it doesn’t point to a\nproper source either.\n\nAccording to Wikipedia, versions 2.4.x to 2.9.x are still supported.\nThis surprised me, because the fix for CVE-2017-14867 [2] hasn’t been\nbackported to versions earlier than 2.10 if I see that correctly.\nCVE-2017-14867 was fixed for Git series 2.10.x and newer on September\n22, 2017, and publicly disclosed on September 29, 2017. However, the\nlatest releases for the 2.7.x, 2.8.x, and 2.9.x series date back to July\n30, 2017 (and 2.4.x hasn’t been touched since September 4, 2015).\n\nBest wishes,\nPatrick\n\n\n\n\n[1] https://en.wikipedia.org/wiki/Git#Releases\n\n[2] https://www.cvedetails.com/cve/CVE-2017-14867/\n\n"},{"id":"348347","messageId":"xmqq8t8bvz6x.fsf@gitster-ct.c.googlers.com","threadId":"48548","inReplyTo":"b5856696-bfcf-173a-49ac-6aa6989316d3@luehne.de","subject":"Re: Officially supported Git versions","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2018-05-23T03:16:38Z","receivedAt":"2018-05-23T03:16:43Z","isPatch":false,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"Patrick Lühne <patrick@luehne.de> writes:\n\n> Is there an official list of the Git versions that are still actively\n> supported?\n\nDepends on your definition of \"official\".  Distro with lts may patch\nolder maintenance tracks longer than the upstream releases do, and\nas far as the normal end-users are concerned, Distro packaged\nbinaries are as \"offcial\" as they get, probably more \"official\" than\nwhat comes from the upstream and then built from the source.\n\nI however do not think distro folks advertise which maintenance\ntracks they backport the patches here on this mailing list.\n\nAs to the \"upstream\", usually 'maint' track gets all fixes, and\nprobably one or two older maintenance tracks tend to get security\nfixes as well.  Beyond that horizon, it's pretty much \"as time\npermits\" basis.\n\n"}]}