The project plans to produce the following types of releases:

• Regular: Introduce new features and enhancements. These releases are targeted for users who require the newest features as early as possible and are able to upgrade when the releases are available. Unlike LTS releases, these are supported only up to the next regular or LTS release.
• Long Term Support (LTS):  Focuses on the stability and longevity of releases at the expense of new features.  These releases are targeted for users who require stability over the availability of new features and/or have longer support and upgrade windows.
• Security: Small releases that include only CVE fixes. These releases are produced for all impacted and supported Regular and LTS releases at the time of ACS PMC addressing the CVE(s). Because these releases contain only CVE fixes, all users should upgrade to the latest security release of their preferred type (regular or LTS) as soon as possible.

This LTS release cycle has the following goals:

• Stability over new features: Deliver releases that only address defects and CVEs. No features or enhancements** would be backported to LTS release branches. This greatly reduces the upgrade risk / operational impact.
• Reliable Release Lifetimes: The LTS release cycle will provide users with reliable support and upgrade time frames.
  ** LTS may accept enhancement if it adds support or improvements for an core components such as support for a new hypervisor versions, guest OSs, and maintenance of core infrastructure plugins (storage, networks etc) to allow users to upgrade their infra without requiring them to perform a full CloudStack major upgrade.

For more details on release principles and versioning please refer to CloudStack Release Principles and Releases pages. 

Long-Term Service (LTS) Release Cycle

LTS branches are supported for a total of 24 months* in the following manner:

• 1-18 months: All defect fixes, improvements, as well as fixes for Blocker, Critical, and CVEs identified in the LTS branch will be merged and shipped as part of proactive maintenance releases.
• 18-24 months: All Blocker defects and CVEs that impact the LTS branch will be merged and shipped as part of security/maintenance releases as needed.

* starting 4.20 (previous versions supported for upto 18 months)

The following are the types of changes that are permitted and guarantees provided to users:

• Defect fixes only. Enhancements for that expand support for existing plugins (e.g. hypervisor, storage, network, orchestration etc. plugins) and additional JDK/JRE or MySQL versions may be considered if the change is sufficiently isolated and do not introduce significant-quality risks to the branch.
• Database changes will be limited to those required to address defect fixes or limitations.
• Supported JDK/JRE, MySQL, and Linux distribution versions will not be removed throughout the cycle.

Defect fixes that originate in an LTS branch will be forward merged to the supported LTS release(s) and main branches.

Security Release Cycle

When a CVE is identified, the security team requires a private, expedited release process to address the issue.  Users also need a release that is constrained to fixing only the CVE to minimize upgrade risk and downtime.  Therefore, when a security release is required, the security team will review the proposed patch privately with a minimum of two (2) LGTMs required per our release principles.  The patch will be forward merged to every impacted regular and LTS release currently supported – incrementing the security patch number.  The security team will then create a release candidate for each security release and vote on each release candidate according to the community's bylaws. Security issues should be reported to security@apache.org and also refer to https://cloudstack.apache.org/security

LTS Release Calendar

Notes:

• These dates assume that no blocker or critical defects are identified that require an earlier release
• Release dates are based on the git tag or source tarball date
• LTS releases starting with the first major release will be supported for a minimum of 6 months after next LTS release or a total period of 18 months, whichever is greater