Commit f8ce57ed717 for woocommerce
commit f8ce57ed717053b2cf112276763be2c72072d24d
Author: Rafael Meneses <meneses.tio@gmail.com>
Date: Tue Aug 4 15:14:26 2026 -0300
Add a security patch support policy to the release docs (#67353)
* docs: Add security patch support policy for older versions
Security patches for older WooCommerce versions are decided
case-by-case: recent fixes were backported across a large number of
older versions with no defined support window, and nothing tells
merchants or extension developers which versions can expect fixes.
State the policy in the release docs: security patches cover the last
21 major versions (9.0 and newer as of 11.0), a rolling count that the
stable-release run-book moves forward each cycle so the page cannot go
stale. For critical, actively exploited vulnerabilities the security
team decides how far back to patch. Linked from the releases overview
and the point-releases page.
Refs ARC-1872
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* docs: Move the security floor update into the publish-release step
The floor-update task sat at the end of the post-release section, after
the 3-day monitoring bullet, which read as if the floor moves days after
the release. The supported-version floor changes the moment the stable
release of a new major version is published, so the task belongs in the
publish step.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* docs: Clarify the security support window wording
"As of WooCommerce 11.0" read as a statement about when the policy took
effect rather than a worked example of the rolling window. Phrase it as
a conditional example and name the run-book task with the policy's own
term, supported-version floor, pointing at the publish step it now
lives in.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* docs: Add a sidebar position to the security support page
Every other page in the releases docs section declares sidebar_position;
without one the new page's placement in the docs-site nav is undefined.
Positions 1-9 are taken, so the policy page goes last as reference
material.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
diff --git a/.linear/release-kickoff-patch.md b/.linear/release-kickoff-patch.md
index 873e4c3cc2c..2ab2311bf5f 100644
--- a/.linear/release-kickoff-patch.md
+++ b/.linear/release-kickoff-patch.md
@@ -62,6 +62,7 @@ For scheduled releases, the readiness review is the one in the RC sub-issue. Poi
- [ ] Run workflow **[Release: Update stable tag]({repository_url}/actions/workflows/release-update-stable-tag.yml)**: enter `{release_version}` as _Version_ and make sure to check 'I confirm that I want to update the stable tag (this will update the SVN and GitHub stable tags).'
- [ ] Publish the `{release_version}` [release draft]({repository_url}/releases) that was previously created, as well as any other `{release_main_version}` drafts that might exist from previous attempts. **Ensure** that "Set as the latest release" is checked for `{release_version}`.
+- [ ] If this is the stable release of a new major version: move the supported-version floor forward in the [security support policy](https://developer.woocommerce.com/docs/contribution/releases/security-support/) page (last 21 major versions).
### 7. Post-release tasks
diff --git a/docs/contribution/releases/README.md b/docs/contribution/releases/README.md
index f790f042c84..2f0ab3956af 100644
--- a/docs/contribution/releases/README.md
+++ b/docs/contribution/releases/README.md
@@ -13,6 +13,7 @@ The WooCommerce release process is managed by a rotating release lead, paired wi
* [Readiness and Go/No-Go](/docs/contribution/releases/readiness)
* [Troubleshooting](/docs/contribution/releases/troubleshooting)
* [Point Releases](/docs/contribution/releases/point-releases)
+* [Security Support](/docs/contribution/releases/security-support)
* [Cherry-picking](/docs/contribution/releases/backporting)
* [Pre-releases](/docs/contribution/releases/prereleases)
* [Release Schedule](/docs/contribution/releases/schedule)
diff --git a/docs/contribution/releases/point-releases.md b/docs/contribution/releases/point-releases.md
index 85e7f3ac353..d6fc4090752 100644
--- a/docs/contribution/releases/point-releases.md
+++ b/docs/contribution/releases/point-releases.md
@@ -17,7 +17,7 @@ Point releases are patch releases that address specific issues in an already-shi
Changes appropriate for a point release are:
- **Critical bug fixes** affecting store functionality (checkout, orders, payments, product visibility).
-- **Security patches** for urgent vulnerabilities.
+- **Security patches** for urgent vulnerabilities ([which versions receive them](/docs/contribution/releases/security-support)).
- **Severe performance regressions** introduced by the shipped release.
- **Compliance fixes** required for regulatory or legal reasons.
- **Compatibility fixes** for WordPress, theme, or plugin conflicts that are breaking stores.
diff --git a/docs/contribution/releases/security-support.md b/docs/contribution/releases/security-support.md
new file mode 100644
index 00000000000..11c900184e4
--- /dev/null
+++ b/docs/contribution/releases/security-support.md
@@ -0,0 +1,29 @@
+---
+post_title: WooCommerce Security Patch Support Policy
+sidebar_label: Security Support
+sidebar_position: 10
+---
+
+# Security Patch Support Policy
+
+WooCommerce provides security patches for the **last 21 major versions**. If the current stable WooCommerce version is 11.0, that means version **9.0 and newer**.
+
+"Major version" follows WooCommerce's release numbering (`10.8`, `10.9`, `11.0`, ...), not semantic versioning. At the current release cadence, 21 major versions correspond to roughly two years of releases.
+
+## What this means
+
+- Security fixes are backported to every supported major version affected by the vulnerability, and ship as [point releases](/docs/contribution/releases/point-releases).
+- Versions older than the support window do not receive security patches. Stores on unsupported versions must update to a supported version to receive fixes.
+- The window is a rolling count: each new major release moves the floor up by one version.
+
+## Exceptions
+
+For critical vulnerabilities - actively exploited, or with severe impact (for example CVSS 9.0+) - the security team may patch versions beyond the standard window. How far back to patch is at the security team's discretion, weighing exploitation risk against the affected install base.
+
+## Reporting
+
+Security vulnerabilities must be reported privately through Automattic's HackerOne program: [https://hackerone.com/automattic/](https://hackerone.com/automattic/). Never report them in public issues.
+
+## Keeping this page current
+
+The release run-book's publish steps include moving the supported-version floor forward when the stable release of a new major version ships.