{"thread":{"id":"53472","subject":"Git stable releases","startedAt":"2020-05-14T20:25:24Z","lastAt":"2020-05-24T16:26:20Z","messageCount":5,"participants":["John Carlissi","Elijah Newren","Junio C Hamano"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"397822","messageId":"CAGa9yXqOY0onB4cg4rjCY+RCL7qqxtYDBT+B9DoJ3nwpKh5_Hg@mail.gmail.com","threadId":"53472","inReplyTo":null,"subject":"Git stable releases","fromName":"John Carlissi","fromEmail":"johncarlissi@gmail.com","sentAt":"2020-05-14T20:25:10Z","receivedAt":"2020-05-14T20:25:24Z","isPatch":false,"sender":{"key":"johncarlissi@gmail.com","avatar":null},"body":"I noticed that with 2.16.6 development stopped whereas with the latest\nsecurity update, everything 2.17 and newer got the fix. Is there any\nformal definition as to when a minor version is EOL and no longer gets\nsecurity updates?\nThanks!\n"},{"id":"398425","messageId":"CAGa9yXq1FwLJdFqnnino-34pMtTcvu8pZWhgHPoBY6mJBd=yfQ@mail.gmail.com","threadId":"53472","inReplyTo":"CAGa9yXqOY0onB4cg4rjCY+RCL7qqxtYDBT+B9DoJ3nwpKh5_Hg@mail.gmail.com","subject":"Re: Git stable releases","fromName":"John Carlissi","fromEmail":"johncarlissi@gmail.com","sentAt":"2020-05-22T15:32:57Z","receivedAt":"2020-05-22T15:33:11Z","isPatch":false,"sender":{"key":"johncarlissi@gmail.com","avatar":null},"body":"On Thu, May 14, 2020 at 4:25 PM John Carlissi wrote:\n>\n> I noticed that with 2.16.6 development stopped whereas with the latest\n> security update, everything 2.17 and newer got the fix. Is there any\n> formal definition as to when a minor version is EOL and no longer gets\n> security updates?\n> Thanks!\n\nDoes the silence mean there is no formal definition or did this\nmessage just get lost in the pile?\n"},{"id":"398432","messageId":"CABPp-BEjrViPSXVg9h_1wCHzRSB3uG-93_nsjOOgLQ4mVhnkRA@mail.gmail.com","threadId":"53472","inReplyTo":"CAGa9yXq1FwLJdFqnnino-34pMtTcvu8pZWhgHPoBY6mJBd=yfQ@mail.gmail.com","subject":"Re: Git stable releases","fromName":"Elijah Newren","fromEmail":"newren@gmail.com","sentAt":"2020-05-22T16:54:59Z","receivedAt":"2020-05-22T16:55:13Z","isPatch":false,"sender":{"key":"newren@gmail.com","avatar":"https://avatars.githubusercontent.com/u/5455730?v=4"},"body":"On Fri, May 22, 2020 at 8:38 AM John Carlissi wrote:\n>\n> On Thu, May 14, 2020 at 4:25 PM John Carlissi wrote:\n> >\n> > I noticed that with 2.16.6 development stopped whereas with the latest\n> > security update, everything 2.17 and newer got the fix. Is there any\n> > formal definition as to when a minor version is EOL and no longer gets\n> > security updates?\n> > Thanks!\n>\n> Does the silence mean there is no formal definition or did this\n> message just get lost in the pile?\n\nThese mails from the maintainer may be of interest to you, though I\nthink they lean towards there being no formal definition:\n\nhttps://lore.kernel.org/git/xmqqwo5luj6r.fsf@gitster.c.googlers.com/\n\nhttps://lore.kernel.org/git/xmqq8t8bvz6x.fsf@gitster-ct.c.googlers.com/\n"},{"id":"398440","messageId":"CAGa9yXpz3Z=F3k_BXXoySBEWU26UjzzrMoxT3P1ZMcMSSL4pNw@mail.gmail.com","threadId":"53472","inReplyTo":"CABPp-BEjrViPSXVg9h_1wCHzRSB3uG-93_nsjOOgLQ4mVhnkRA@mail.gmail.com","subject":"Re: Git stable releases","fromName":"John Carlissi","fromEmail":"johncarlissi@gmail.com","sentAt":"2020-05-22T21:06:23Z","receivedAt":"2020-05-22T21:06:38Z","isPatch":false,"sender":{"key":"johncarlissi@gmail.com","avatar":null},"body":"On Fri, May 22, 2020 at 12:55 PM Elijah Newren wrote:\n>\n> These mails from the maintainer may be of interest to you, though I\n> think they lean towards there being no formal definition:\n>\n> https://lore.kernel.org/git/xmqqwo5luj6r.fsf@gitster.c.googlers.com/\n>\n> https://lore.kernel.org/git/xmqq8t8bvz6x.fsf@gitster-ct.c.googlers.com/\n\nThank you for those links.\n"},{"id":"398473","messageId":"xmqq367pqoyj.fsf@gitster.c.googlers.com","threadId":"53472","inReplyTo":"CAGa9yXqOY0onB4cg4rjCY+RCL7qqxtYDBT+B9DoJ3nwpKh5_Hg@mail.gmail.com","subject":"Re: Git stable releases","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2020-05-24T16:26:12Z","receivedAt":"2020-05-24T16:26:20Z","isPatch":false,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"John Carlissi writes:\n\n> I noticed that with 2.16.6 development stopped whereas with the latest\n> security update, everything 2.17 and newer got the fix. Is there any\n> formal definition as to when a minor version is EOL and no longer gets\n> security updates?\n\nNothing formal, but I try not to give a false sense of security by\nbackmerging a fix to maintenance tracks that are too old. Unless\na \"fix\" is quite trivial, it always risks introducing new bugs,\ngiven that most developers and testers work on the more modern\ncodebase. A call to a helper that is made to \"fix\" an issue may be\nsafe in today's codebase, but the same helper in the ancient\nmaintenance track may not have been updated to match what the new\ncallsite expects it to do, for example.\n\nLimiting backmerging also is a way to encourage people to update to\nthe latest major releases.\n\nI currently aim to limit to at most four or five of maintenance\ntracks. Each development cycle usually lasts for 8-10 weeks, so\nthat means the shelf life of a major release is about 8 months at\nthe most---but sometimes people get greedy and demand backmerging to\nway older tracks. The last one for 2.17.x track was an example.\n\nOf course, the above does not mean distro packagers and managers of\nplatform specific ports are not allowed to backport the fixes to\nolder codebase than I cut \"official\" maitenance releases for.\n\n"}]}