We support only the latest version and we follow SemVer, so all minor and patch releases are backwards compatible.
You should feel comfortable upgrading if you're using our documented public APIs and pay attention to DeprecationWarnings. Whenever there is a need to break compatibility, it is announced in the changelog and raises a DeprecationWarning before it's finally really broken.
If you think you found a vulnerability, please report it at conda-store/security.
This policy covers the following repositories: