-
-
Notifications
You must be signed in to change notification settings - Fork 1.7k
Add versioning and support policy information #3341
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: 2.x
Are you sure you want to change the base?
Conversation
This PR introduces a new `versioning` page under *Support* that summarizes the support status of Apache Log4j releases and documents the long-standing project policy: * Log4j follows semantic versioning. * Only the latest minor of the latest major receives patch releases for bug and security fixes. * Vulnerability reports are accepted for **all** `2.x` releases. * Log4j `1.x` is EOL and no longer accepts vulnerability reports. Related to #1867 Fixes #3988
b263d09 to
cfdb98b
Compare
FreeAndNil
left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM
vy
left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I haven't reviewed the most recent changes yet. But in its current state, it creates yet another page that needs to be updated during a release, and we should not merge this without reflecting this on the release instructions.
Can we programmatically populate this content? Reuse some existing properties in pom.xml? (Adding yet another property to pom.xml that needs to be manually updated during a release is not a better option.)
|
I added more precise release instructions in apache/logging-parent#453, but lifecycle documentation can’t really be automated today. Lifecycle events ( ATR will simplify this in the future (see apache/tooling-trusted-releases#183), so adding project-specific automation now doesn’t seem worthwhile. The Log4j release automation you built has saved days of work across a dozen releases and is finally paying off. Automating lifecycle information would offer far smaller benefits. |
vy
left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I've tried to shorten the content (e.g., no need to list versions in the policy page) and fixed/improved some typesetting. I still think this is a maintenance burden for a feature that no user has asked for. If it happens to be forgotten during a release, I trust that @FreeAndNil and @ppkarwasz will volunteer to fix it.
This PR adds information about the support status of various Apache Log4j releases.
Related to #1867