Page History

...

End of life is an industry standard concept that we apply at the ASF.  End of life means no more patches. Like all software products, ASF code lines go through a lifecycle that terminates in end of support.  Typically, ASF PMCs communicate end of support dates for products or code lines with ample time (one year plus) for users to plan upgrades or find alternatives.  Once communicated end of life dates arrive, the PMC is no longer expected or required to accept or apply patches to the end of life versions. This includes security patches against identified vulnerabilities. Therefore in some cases, when users who are depending on no longer supported versions of ASF software,  a version upgrade will be required on the users side to obtain a fix of an identified vulnerability and that which may also require code changes to integratebe integrated.  The ASF security team may still issue CVE names against EOL software to help users quantify the risk. 

End of life software running in critical systems is a systemic risk which is not unique to open source software or the ASF.

...