Skip to content

Conversation

@darosior
Copy link
Member

This updates the release lifecycle page to more closely reflect our actual releases. This started as an effort to drop the superfluous EOM status, but ended up as a rewrite of the Versioning, Maintenance and Schedule sections since all were depending on each other.

We only make a distinction between maintained and EOL versions. The EOM status adds unnecessary complexity and is misleading, so remove it.

This also cleans up the Versioning section, which was using three major heading (Versioning, Major releases and Maintenance releases) for a small amount of content all on the same topic of how the software we release is versioned. This also cleans up a redundant statement about backporting consensus changes and removes an unnecessary statement about the distinction between minor and major features for backports (which we don't even follow nowadays as far as i know).

Then we rewrite the maintenance version, which was making a distinction between "maintenance end" and "end of life" that we do not follow in practice, and overall makes it clearer and more concise. In this section i also remove some confused language about how we handle security fixes, which is not consistent with our practice, in favour of a general sentence that EOL versions do not receive security fixes and a link to our Security Advisories page which gives more details on this topic.

Wherever i touched i also updated the examples to use newer versions. In some cases i also switched from pointing to the exact major release (X.0) to the major version (X.Y) which is more accurate and also what we already do on the security advisories page.

@darosior
Copy link
Member Author

Here is how it looks like after this change
image

@darosior
Copy link
Member Author

Some archeology:

  • The EOM status was introduced in Initial Software EOL policy #37 (0959320)
  • The original EOL policy was discussed in this IRC meeting, though as far as i can tell there was no mention of the EOM status. My understanding was that participants essentially discussed what is in effect our currently observed EOL policy but only for the past two major versions (what's as EOM on the website)

Copy link
Member

@fanquake fanquake left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Concept ACK. I think this better aligns with what the project is currently doing.

Copy link
Contributor

@murchandamus murchandamus left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I guess I was one of the people that was confused by the previous description, but from what I can tell, it had been the modus operandi to put out minor releases for the the prior two branches around a new major release, e.g., we put out minor releases for 29.x and 28.x around the release of 30.0, and from what I understand that’ll be the last time there will be a release from the 28.x branch. If 28.x won’t get any further releases, wouldn’t it then be correct to classify 28.x as “unmaintained” at that point?
Wouldn’t it therefore make more sense to refer to the last two major branches as maintained instead of the last three?
In that sense, the “Maintenance End” column seems more relevant to me than the “End of Life” column.

Copy link
Contributor

@murchandamus murchandamus left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ACK 70e2425,

with a few optional suggestions.

@ajtowns
Copy link
Contributor

ajtowns commented Dec 11, 2025

we put out minor releases for 29.x and 28.x around the release of 30.0, and from what I understand that’ll be the last time there will be a release from the 28.x branch.

Given 30.x is the current release, I think the maintenance policy is something like:

  • 30.x gets moderate backport efforts, including eg:
    • some new features, some bug fixes
    • fixes for disclosed security issues
    • covert fixes for undisclosed medium and above security issues where feasible
  • 29.x get lower backport efforts, with only some of the 30.x backports making it to 29.x
  • 28.x gets low backport efforts, with only some of the 29.x backports making it to 28.x
  • new point releases are made based on the maintainers' judgement

I'm not sure about releases older than that? The release-process.md doc says EOL branches get a -final tag and get deleted, but 24.x-27.x still exist. Deliberately keeping the 24.x-27.x branches (ie the most recent four EOL branches) alive for exceptional backports (a critical severity issue that is being actively exploited?) seems plausible to me, fwiw.

For a security bug that was fixed during the 30.x development cycle, and included in the 30.0 release, the disclosure timeline is:

  • low severity: two weeks after 30.0's release, at which point backporting the fix to 29.x, 28.x becomes easy because the fix doesn't need to be covert
  • medium/high severity: two weeks after 32.0 is released (by which point 29.x and 28.x are end of life)
  • critical severity: ad-hoc

As I understand it, even if medium/high severity bugs that get a covert backport into 29.x or 28.x, that doesn't affect the disclosure timeline.

Perhaps we should provide a more concrete disclosure timeline/schedule somewhere, eg:

  • Security issues fixed in 25.0:
    • Medium/high severity: Disclosed 2024-10-09 (six months after 24.x EOL)
  • Security issues fixes in 26.0:
    • Medium/high severity: Disclosed 2024-11-05 (one month after 25.x EOL)
  • Security issues fixed in 29.0:
    • Low severity: Disclosed 2025-04-28
    • Medium/high severity: Expected disclosure 2026Q2 after release of 31.0 and EOL of 28.x
  • Security issues fixed in 30.0:
    • Low severity: Disclosed 2025-10-24
    • Medium/high severity: Expected disclosure 2026Q4 after release of 32.0 and EOL of 29.x

@willcl-ark
Copy link
Member

Concept ACK, seems like a nice improvement.

I'd be happy to see this go in as-is after the above comments have been addressed, but I also took a stab at improving the general readability of the page a bit myself in willcl-ark@58bbe58, or in rendered form at https://github.com/willcl-ark/bitcoincore.org/blob/pr-1200/_posts/en/pages/2016-01-15-lifecycle.md, as I was reviewing the overall document.

Feel free to take any changes from there that you like.

@darosior
Copy link
Member Author

darosior commented Jan 9, 2026

@willcl-ark nice, thank you for doing this. I think this is mostly a desirable change, but a bit more than i'd like to do in this PR, and i have a couple small nits. Could you open it as a follow-up PR where i can leave a review comment?

Copy link
Contributor

@murchandamus murchandamus left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ACK 4b5bb81

@darosior
Copy link
Member Author

darosior commented Jan 9, 2026

Addressed comments, fixed CI (update now-outdated links to deleted section), and made one tiny modification in the introduction after a second read.

We only make a difference between maintained versions and end of life versions. To reflect this
practice, update the lifecycle page to drop the confusing EOM status.

While at it, update the versioning and maintenance sections to more closely reflect the current
practices of the project.
Copy link
Contributor

@murchandamus murchandamus left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ACK 84ddcf0

Copy link
Member

@willcl-ark willcl-ark left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM. ACK 84ddcf0

Copy link

@sedited sedited left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ACK 84ddcf0

@fanquake fanquake merged commit b2da596 into bitcoin-core:master Jan 13, 2026
2 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

6 participants