Supported versions #

This page is for project managers, contract managers and security officers in a public body. It answers: which versions of Exponential get security fixes, what "supported" means in practice, and how to keep a site on a supported version for the term of a contract. The source is SECURITY.md in the repository root.

Contents #

1. The table
2. What "supported" means
3. Older lines
4. Extensions
5. In a contract

The table #

From SECURITY.md:

"Exponential 6.0 is the maintained line. Security fixes are made on the main branch (the 6.0.15 line, dev-main) and published with the next 6.0.x release."

What "supported" means #

• A fix is a new release. There are no back-ported patches for older 6.0.x tags. To receive a fix, the site moves to the newest 6.0.x. Plan for that: every site must be able to upgrade within the 6.0 line without a project.
• Reports are answered. A private report to the address in SECURITY.md gets "a first answer within one business day". SECURITY.md does not promise a time to fix.
• No end-of-life dates are published. SECURITY.md states which lines are supported today; it does not say for how long. Ask your supplier how they will keep you informed.

The project's wider support commitments (PHP versions, releases, documentation) are collected in Who is the Exponential Foundation?.

Older lines #

A site on 5.x, 4.x or older receives no fixes. The migration chapters of the installation book bring such sites to 6.0: 14. Migrating from the 4.x line, 15. Migrating from the 5.x legacy stack and 16. Migrating from eZ Platform and Ibexa. Sites of that era ran on the code base of eZ Publish, which its creator discontinued after almost eighteen years; Exponential continues that code base (Who is 7x?).

A site that must stay on PHP 7.4 can run the maintained line again from 6.0.15, without support and without the features that need PHP 8 (2. Requirements).

Extensions #

Extensions are separate packages with their own versions. Each records its version in ezinfo.php and extension.xml (Source control and releases), and the about page lists them. SECURITY.md covers the kernel repository; for each extension your site uses, check its own repository and changelog in doc/changelogs/extensions/. Extensions written for you by a supplier are supported only as the contract says.

In a contract #

Supported versions
1. The Supplier keeps the Site on the newest released 6.0.x version of Exponential, or on a version
   no older than <n> releases behind it, as listed in SECURITY.md of the Exponential repository.
2. When a release fixes a security issue, the Supplier upgrades the Site within <time> of the release
   (see the security update clause).
3. The Supplier reports the kernel version and every extension version in each <period> report,
   as shown by Setup > System information and the about page.
4. If the Site uses a line that SECURITY.md no longer lists as supported, the Supplier proposes a
   migration plan within <time>.

Fill in the times yourself; nothing in the project sets them. The tender templates part of this procurement section has longer clauses.

Related pages #

• The product lifecycle
• Release policy and version numbers
• Security updates and patching cadence
• Free documentation: this page is free to copy, translate and improve under the GNU FDL 1.3.