Add versioning and support policy information #3341
Conversation
This PR introduces a new `versioning` page under *Support* that summarizes the support status of Apache Log4j releases and documents the long-standing project policy: * Log4j follows semantic versioning. * Only the latest minor of the latest major receives patch releases for bug and security fixes. * Vulnerability reports are accepted for **all** `2.x` releases. * Log4j `1.x` is EOL and no longer accepts vulnerability reports. Related to #1867 Fixes #3988
ppkarwasz
force-pushed
the
doc/2.x/versioning
branch
from
b263d09 to
cfdb98b
Compare
vy
left a comment
vy
left a comment
There was a problem hiding this comment.
I haven't reviewed the most recent changes yet. But in its current state, it creates yet another page that needs to be updated during a release, and we should not merge this without reflecting this on the release instructions.
Can we programmatically populate this content? Reuse some existing properties in pom.xml? (Adding yet another property to pom.xml that needs to be manually updated during a release is not a better option.)
|
I added more precise release instructions in apache/logging-parent#453, but lifecycle documentation can’t really be automated today. Lifecycle events ( ATR will simplify this in the future (see apache/tooling-trusted-releases#183), so adding project-specific automation now doesn’t seem worthwhile. The Log4j release automation you built has saved days of work across a dozen releases and is finally paying off. Automating lifecycle information would offer far smaller benefits. |
vy
left a comment
vy
left a comment
There was a problem hiding this comment.
I've tried to shorten the content (e.g., no need to list versions in the policy page) and fixed/improved some typesetting. I still think this is a maintenance burden for a feature that no user has asked for. If it happens to be forgotten during a release, I trust that @FreeAndNil and @ppkarwasz will volunteer to fix it.
|
@vy, Yes, I will update this page if we forget to update it during a release. Next year I plan to integrate our release process with Apache Trusted Releases, which will allow us to automate this page too. |
This PR introduces a new `versioning` page under *Support* that summarizes the support status of Apache Log4j releases and documents the long-standing project policy: * Log4j follows semantic versioning. * Only the latest minor of the latest major receives patch releases for bug and security fixes. * Vulnerability reports are accepted for **all** `2.x` releases. * Log4j `1.x` is EOL and no longer accepts vulnerability reports. Related to #1867 Fixes #3988 Co-authored-by: Volkan Yazıcı <[email protected]>
3 participants
This PR adds information about the support status of various Apache Log4j releases.
Related to #1867