Supported releases and lifecycle?

[scw]

I saw that there's a new release of 75.3.4, but not newer releases of e.g. 75.8 or 75.9, does 75.3 carry a special role? It would be awesome to have some documentation on the expected support lifecycle for different versions. In practice, there are likely many versions being used in production, but only a handful of those will be targeted for security fixes and it'd be nice to reference that information explicitly.

[abravalheri]

Hi, in general, fixes are added on top of the latest version and a new release is created in a "monotonically increasing" fashion. The TL;DR Is that the project only has resources to support one release: the latest one.

There are situations however that the community comes together to provide backports of such fixes for older versions (note however that the recommended version is still the highest number available).

We had mixed experiences with those backports in the past: while there was members of community that put a lot of effort in creating them and value them, they also created confusion for other members of the community (like this very own)...

So unless you have a strong reason to desire a backport to an old version, the best is to stick with the highest available number.

There is some documentation in:

• https://setuptools.pypa.io/en/latest/userguide/interfaces.html
• https://setuptools.pypa.io/en/latest/deprecated/sdist-reproducibility.html
• https://setuptools.pypa.io/en/latest/development/releases.html.

But please feel free to open a PR if you have some improvement in mind.