Security Policy and Supported Versions

The Pulsar community will announce security vulnerabilities and how to mitigate them on the users@pulsar.apache.org. For instructions on how to subscribe, please see .

The Pulsar project adheres to Semantic Versioning. Existing releases can expect patches for bugs and security vulnerabilities. New features will target minor releases.

Feature release branches will be maintained with security fix and bug fix releases for a period of at least 12 months after initial release. For example, branch 2.5.x is no longer considered maintained as of January 2021, 12 months after the release of 2.5.0 in January 2020. No more 2.5.x releases should be expected at this point, even to fix security vulnerabilities.

Note that a minor version can be maintained past it’s 12 month initial support period. For example, version 2.7 is still actively maintained.

When 3.0.0 is released, the community will decide how to continue supporting 2.x. It is possible that the last minor release within 2.x will be maintained for longer as an “LTS” release, but it has not been officially decided.

The following table shows version support timelines and will be updated with each release.

With the acceptance of , the Pulsar community aims to complete 4 minor releases each year. Patch releases are completed based on demand as well as need, in the event of security fixes.